Changelog

Amazon Interactive Video Service

• ivs:DeletePublicKey
• ivs:GetPublicKey
• ivs:ImportPublicKey
• ivs:ListPublicKeys

Amazon Bedrock

• bedrock:CreateFlow
• bedrock:CreateFlowAlias
• bedrock:CreateFlowVersion
• bedrock:CreatePrompt
• bedrock:CreatePromptVersion
• bedrock:DeleteAgentMemory
• bedrock:DeleteFlow
• bedrock:DeleteFlowAlias
• bedrock:DeleteFlowVersion
• bedrock:DeletePrompt
• bedrock:GetAgentMemory
• bedrock:GetFlow
• bedrock:GetFlowAlias
• bedrock:GetFlowVersion
• bedrock:GetPrompt
• bedrock:InvokeFlow
• bedrock:ListFlowAliases
• bedrock:ListFlowVersions
• bedrock:ListFlows
• bedrock:ListPrompts
• bedrock:PrepareFlow
• bedrock:UpdateFlow
• bedrock:UpdateFlowAlias
• bedrock:UpdatePrompt

Amazon CloudFront

• cloudfront:UpdateDistributionWithStagingConfig

AWS HealthImaging

• medical-imaging:GetDICOMInstanceFrames
• medical-imaging:GetDICOMInstanceMetadata

AWS License Manager Linux Subscriptions Manager

• license-manager-linux-subscriptions:DeregisterSubscriptionProvider
• license-manager-linux-subscriptions:GetRegisteredSubscriptionProvider
• license-manager-linux-subscriptions:ListRegisteredSubscriptionProviders
• license-manager-linux-subscriptions:ListTagsForResource
• license-manager-linux-subscriptions:RegisterSubscriptionProvider
• license-manager-linux-subscriptions:TagResource
• license-manager-linux-subscriptions:UntagResource

Amazon SageMaker

• sagemaker:CreateOptimizationJob
• sagemaker:DeleteOptimization
• sagemaker:DescribeOptimizationJob
• sagemaker:ListOptimizationJobs
• sagemaker:StopOptimizationJob

AWS App Studio

• appstudio:GetAccountStatus
• appstudio:GetEnablementJobStatus
• appstudio:StartEnablementJob
• appstudio:StartRollbackEnablementJob
• appstudio:StartTeamDeployment

AWS Elemental MediaConvert

• mediaconvert:SearchJobs

Amazon Q Business Q Apps

• qapps:ListTagsForResource
• qapps:UntagResource

Amazon SageMaker

• sagemaker:CreateHubContentReference
• sagemaker:DeleteHubContentReference
• sagemaker:DeployHubModel

AWS Systems Manager Quick Setup

• ssm-quicksetup:CreateConfigurationManager
• ssm-quicksetup:DeleteConfigurationManager
• ssm-quicksetup:GetConfigurationManager
• ssm-quicksetup:GetServiceSettings
• ssm-quicksetup:ListConfigurationManagers
• ssm-quicksetup:ListQuickSetupTypes
• ssm-quicksetup:ListTagsForResource
• ssm-quicksetup:TagResource
• ssm-quicksetup:UntagResource
• ssm-quicksetup:UpdateConfigurationDefinition
• ssm-quicksetup:UpdateConfigurationManager
• ssm-quicksetup:UpdateServiceSettings

AWS CloudHSM

• cloudhsm:DeleteResourcePolicy
• cloudhsm:GetResourcePolicy
• cloudhsm:PutResourcePolicy

Amazon Connect Customer Profiles

• profile:CreateSnapshot
• profile:GetSnapshot

Amazon DataZone

• datazone:CreateAssetFilter
• datazone:DeleteAssetFilter
• datazone:GetAssetFilter
• datazone:GetLineageNode
• datazone:ListAssetFilters
• datazone:ListLineageNodeHistory
• datazone:PostLineageEvent
• datazone:UpdateAssetFilter

Amazon Q Business Q Apps

• qapps:AssociateLibraryItemReview
• qapps:DisassociateLibraryItemReview
• qapps:GetQAppSession
• qapps:GetQAppSessionMetadata
• qapps:ImportDocument
• qapps:PredictQApp
• qapps:TagResource
• qapps:UpdateQAppSession
• qapps:UpdateQAppSessionMetadata

Amazon WorkSpaces

• workspaces:CreateWorkspacesPool
• workspaces:DescribeWorkspacesPoolSessions
• workspaces:DescribeWorkspacesPools
• workspaces:ModifyStreamingProperties
• workspaces:StartWorkspacesPool
• workspaces:StopWorkspacesPool
• workspaces:TerminateWorkspacesPool
• workspaces:TerminateWorkspacesPoolSession
• workspaces:UpdateWorkspacesPool

AWS Control Tower

• controltower:ListLandingZoneOperations

Amazon EC2

• ec2:DescribeTrafficMirrorFilterRules

AWS Glue

• glue:CreateUsageProfile
• glue:DeleteUsageProfile
• glue:GetUsageProfile
• glue:ListUsageProfiles
• glue:UpdateUsageProfile

AWS Compute Optimizer

• compute-optimizer:ExportRDSDatabaseRecommendations
• compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics
• compute-optimizer:GetRDSDatabaseRecommendations

Amazon Connect

• connect:CreateAuthenticationProfile
• connect:DescribeAuthenticationProfile
• connect:ListAuthenticationProfiles
• connect:UpdateAuthenticationProfile

AWS CloudShell

• cloudshell:DescribeEnvironments

Amazon Bedrock

• bedrock:AllowVendedLogDeliveryForResource

Amazon Macie

• macie2:BatchUpdateAutomatedDiscoveryAccounts
• macie2:ListAutomatedDiscoveryAccounts

Amazon SageMaker

• sagemaker:CreateMlflowTrackingServer
• sagemaker:CreatePresignedMlflowTrackingServerUrl
• sagemaker:DeleteMlflowTrackingServer
• sagemaker:DescribeMlflowTrackingServer
• sagemaker:ListMlflowTrackingServers
• sagemaker:StartMlflowTrackingServer
• sagemaker:StopMlflowTrackingServer
• sagemaker:UpdateMlflowTrackingServer

Amazon SageMaker with MLflow

• sagemaker-mlflow:AccessUI
• sagemaker-mlflow:CreateExperiment
• sagemaker-mlflow:CreateModelVersion
• sagemaker-mlflow:CreateRegisteredModel
• sagemaker-mlflow:CreateRun
• sagemaker-mlflow:DeleteExperiment
• sagemaker-mlflow:DeleteModelVersion
• sagemaker-mlflow:DeleteModelVersionTag
• sagemaker-mlflow:DeleteRegisteredModel
• sagemaker-mlflow:DeleteRegisteredModelAlias
• sagemaker-mlflow:DeleteRegisteredModelTag
• sagemaker-mlflow:DeleteRun
• sagemaker-mlflow:DeleteTag
• sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts
• sagemaker-mlflow:GetExperiment
• sagemaker-mlflow:GetExperimentByName
• sagemaker-mlflow:GetLatestModelVersions
• sagemaker-mlflow:GetMetricHistory
• sagemaker-mlflow:GetModelVersion
• sagemaker-mlflow:GetModelVersionByAlias
• sagemaker-mlflow:GetRegisteredModel
• sagemaker-mlflow:GetRun
• sagemaker-mlflow:ListArtifacts
• sagemaker-mlflow:LogBatch
• sagemaker-mlflow:LogInputs
• sagemaker-mlflow:LogMetric
• sagemaker-mlflow:LogModel
• sagemaker-mlflow:LogParam
• sagemaker-mlflow:RenameRegisteredModel
• sagemaker-mlflow:RestoreExperiment
• sagemaker-mlflow:RestoreRun
• sagemaker-mlflow:SearchExperiments
• sagemaker-mlflow:SearchModelVersions
• sagemaker-mlflow:SearchRegisteredModels
• sagemaker-mlflow:SearchRuns
• sagemaker-mlflow:SetExperimentTag
• sagemaker-mlflow:SetModelVersionTag
• sagemaker-mlflow:SetRegisteredModelAlias
• sagemaker-mlflow:SetRegisteredModelTag
• sagemaker-mlflow:SetTag
• sagemaker-mlflow:TransitionModelVersionStage
• sagemaker-mlflow:UpdateExperiment
• sagemaker-mlflow:UpdateModelVersion
• sagemaker-mlflow:UpdateRegisteredModel
• sagemaker-mlflow:UpdateRun

AWS Key Management Service

• kms:DeriveSharedSecret

Amazon DataZone

• datazone:AssociateEnvironmentRole
• datazone:CreateEnvironmentAction
• datazone:DeleteEnvironmentAction
• datazone:DisassociateEnvironmentRole
• datazone:GetEnvironmentAction
• datazone:ListEnvironmentActions
• datazone:UpdateEnvironmentAction

AWS Tax Settings

• tax:BatchDeleteTaxRegistration

Amazon Connect

• connect:SearchContactFlowModules
• connect:SearchContactFlows

AWS Mainframe Modernization Application Testing provides tools and resources for automated functional equivalence testing for your migration projects.

• apptest:CreateTestCase
• apptest:CreateTestConfiguration
• apptest:CreateTestSuite
• apptest:DeleteTestCase
• apptest:DeleteTestConfiguration
• apptest:DeleteTestRun
• apptest:DeleteTestSuite
• apptest:GetTestCase
• apptest:GetTestConfiguration
• apptest:GetTestRunStep
• apptest:GetTestSuite
• apptest:ListTagsForResource
• apptest:ListTestCases
• apptest:ListTestConfigurations
• apptest:ListTestRunSteps
• apptest:ListTestRunTestCases
• apptest:ListTestRuns
• apptest:ListTestSuites
• apptest:StartTestRun
• apptest:TagResource
• apptest:UntagResource
• apptest:UpdateTestCase
• apptest:UpdateTestConfiguration
• apptest:UpdateTestSuite

AWS CloudTrail

• cloudtrail:GenerateQuery

AWS Entity Resolution

• entityresolution:BatchDeleteUniqueId

Amazon S3

• s3:PauseReplication

Amazon GuardDuty

• guardduty:CreateMalwareProtectionPlan
• guardduty:DeleteMalwareProtectionPlan
• guardduty:GetMalwareProtectionPlan
• guardduty:ListMalwareProtectionPlans
• guardduty:UpdateMalwareProtectionPlan

AWS IAM Access Analyzer

• access-analyzer:CheckNoPublicAccess
• access-analyzer:GenerateFindingRecommendation
• access-analyzer:GetFindingRecommendation

AWS Private CA Connector for SCEP

• pca-connector-scep:CreateChallenge
• pca-connector-scep:CreateConnector
• pca-connector-scep:DeleteChallenge
• pca-connector-scep:DeleteConnector
• pca-connector-scep:GetChallengeMetadata
• pca-connector-scep:GetChallengePassword
• pca-connector-scep:GetConnector
• pca-connector-scep:ListChallengeMetadata
• pca-connector-scep:ListConnectors
• pca-connector-scep:ListTagsForResource
• pca-connector-scep:TagResource
• pca-connector-scep:UntagResource

AWS Account Management

• account:AcceptPrimaryEmailUpdate
• account:GetPrimaryEmail
• account:StartPrimaryEmailUpdate

Amazon Location

• geo:ForecastGeofenceEvents
• geo:VerifyDevicePosition

AWS Lake Formation

• lakeformation:GetDataLakePrincipal

AWS Launch Wizard

• launchwizard:GetWorkloadDeploymentPattern
• launchwizard:ListTagsForResource
• launchwizard:TagResource
• launchwizard:UntagResource

AWS Batch

• batch:GetJobQueueSnapshot

Amazon EMR Serverless

• emr-serverless:ListJobRunAttempts

Amazon CloudWatch Application Signals

• application-signals:BatchGetServiceLevelObjectiveBudgetReport
• application-signals:CreateServiceLevelObjective
• application-signals:DeleteServiceLevelObjective
• application-signals:GetService
• application-signals:GetServiceLevelObjective
• application-signals:ListServiceDependencies
• application-signals:ListServiceDependents
• application-signals:ListServiceLevelObjectives
• application-signals:ListServiceOperations
• application-signals:ListServices
• application-signals:ListTagsForResource
• application-signals:StartDiscovery
• application-signals:TagResource
• application-signals:UntagResource
• application-signals:UpdateServiceLevelObjective

Amazon WorkSpaces Secure Browser

• workspaces-web:AssociateBrowserSettings
• workspaces-web:AssociateIpAccessSettings
• workspaces-web:AssociateNetworkSettings
• workspaces-web:AssociateTrustStore
• workspaces-web:AssociateUserAccessLoggingSettings
• workspaces-web:AssociateUserSettings
• workspaces-web:CreateBrowserSettings
• workspaces-web:CreateIdentityProvider
• workspaces-web:CreateIpAccessSettings
• workspaces-web:CreateNetworkSettings
• workspaces-web:CreatePortal
• workspaces-web:CreateTrustStore
• workspaces-web:CreateUserAccessLoggingSettings
• workspaces-web:CreateUserSettings
• workspaces-web:DeleteBrowserSettings
• workspaces-web:DeleteIdentityProvider
• workspaces-web:DeleteIpAccessSettings
• workspaces-web:DeleteNetworkSettings
• workspaces-web:DeletePortal
• workspaces-web:DeleteTrustStore
• workspaces-web:DeleteUserAccessLoggingSettings
• workspaces-web:DeleteUserSettings
• workspaces-web:DisassociateBrowserSettings
• workspaces-web:DisassociateIpAccessSettings
• workspaces-web:DisassociateNetworkSettings
• workspaces-web:DisassociateTrustStore
• workspaces-web:DisassociateUserAccessLoggingSettings
• workspaces-web:DisassociateUserSettings
• workspaces-web:GetBrowserSettings
• workspaces-web:GetIdentityProvider
• workspaces-web:GetIpAccessSettings
• workspaces-web:GetNetworkSettings
• workspaces-web:GetPortal
• workspaces-web:GetPortalServiceProviderMetadata
• workspaces-web:GetTrustStore
• workspaces-web:GetTrustStoreCertificate
• workspaces-web:GetUserAccessLoggingSettings
• workspaces-web:GetUserSettings
• workspaces-web:ListBrowserSettings
• workspaces-web:ListIdentityProviders
• workspaces-web:ListIpAccessSettings
• workspaces-web:ListNetworkSettings
• workspaces-web:ListPortals
• workspaces-web:ListTagsForResource
• workspaces-web:ListTrustStoreCertificates
• workspaces-web:ListTrustStores
• workspaces-web:ListUserAccessLoggingSettings
• workspaces-web:ListUserSettings
• workspaces-web:TagResource
• workspaces-web:UntagResource
• workspaces-web:UpdateBrowserSettings
• workspaces-web:UpdateIdentityProvider
• workspaces-web:UpdateIpAccessSettings
• workspaces-web:UpdateNetworkSettings
• workspaces-web:UpdatePortal
• workspaces-web:UpdateTrustStore
• workspaces-web:UpdateUserAccessLoggingSettings
• workspaces-web:UpdateUserSettings

AWS Glue

• glue:BatchPutDataQualityStatisticAnnotation
• glue:DescribeConnectionType
• glue:DescribeEntity
• glue:GetDataQualityModel
• glue:GetDataQualityModelResult
• glue:ListConnectionTypes
• glue:ListDataQualityStatisticAnnotations
• glue:ListDataQualityStatistics
• glue:ListEntities
• glue:PutDataQualityProfileAnnotation
• glue:RefreshOAuth2Tokens

Amazon Simple Workflow Service

• swf:DeleteActivityType
• swf:DeleteWorkflowType

AWS Chatbot

• chatbot:ListTagsForResource
• chatbot:TagResource
• chatbot:UntagResource

Amazon EC2

• ec2:DisableImageDeregistrationProtection
• ec2:EnableImageDeregistrationProtection
• ec2:GetInstanceTpmEkPub

Amazon EMR Serverless

• emr-serverless:AccessLivyEndpoints

AWS Support Recommendations

• supportrecommendations:GetSupportTroubleshootingResponse
• supportrecommendations:StartSupportTroubleshooting

AWS Payments

• payments:ListPaymentInstruments
• payments:ListTagsForResource
• payments:TagResource
• payments:UntagResource
• payments:UpdatePaymentInstrument

Amazon Simple Email Service - Mail Manager

• ses:CreateAddonInstance
• ses:CreateAddonSubscription
• ses:CreateArchive
• ses:CreateIngressPoint
• ses:CreateRelay
• ses:CreateRuleSet
• ses:CreateTrafficPolicy
• ses:DeleteAddonInstance
• ses:DeleteAddonSubscription
• ses:DeleteArchive
• ses:DeleteIngressPoint
• ses:DeleteRelay
• ses:DeleteRuleSet
• ses:DeleteTrafficPolicy
• ses:GetAddonInstance
• ses:GetAddonSubscription
• ses:GetArchive
• ses:GetArchiveExport
• ses:GetArchiveMessage
• ses:GetArchiveMessageContent
• ses:GetArchiveSearch
• ses:GetArchiveSearchResults
• ses:GetIngressPoint
• ses:GetRelay
• ses:GetRuleSet
• ses:GetTrafficPolicy
• ses:ListAddonInstances
• ses:ListAddonSubscriptions
• ses:ListArchiveExports
• ses:ListArchiveSearches
• ses:ListArchives
• ses:ListIngressPoints
• ses:ListRelays
• ses:ListRuleSets
• ses:ListTagsForResource
• ses:ListTrafficPolicies
• ses:StartArchiveExport
• ses:StartArchiveSearch
• ses:StopArchiveExport
• ses:StopArchiveSearch
• ses:TagResource
• ses:UntagResource
• ses:UpdateArchive
• ses:UpdateIngressPoint
• ses:UpdateRelay
• ses:UpdateRuleSet
• ses:UpdateTrafficPolicy

AWS Control Tower

• controltower:ListControlOperations

AWS HealthImaging

• medical-imaging:GetDICOMInstance

Amazon QuickSight

• quicksight:DescribeKeyRegistration
• quicksight:UpdateKeyRegistration

AWS User Subscriptions

• user-subscriptions:CreateClaim
• user-subscriptions:DeleteClaim
• user-subscriptions:ListApplicationClaims
• user-subscriptions:ListClaims
• user-subscriptions:ListUserSubscriptions
• user-subscriptions:UpdateClaim

Amazon Managed Grafana

• grafana:CreateWorkspaceServiceAccount
• grafana:CreateWorkspaceServiceAccountToken
• grafana:DeleteWorkspaceServiceAccount
• grafana:DeleteWorkspaceServiceAccountToken
• grafana:ListWorkspaceServiceAccountTokens
• grafana:ListWorkspaceServiceAccounts

Amazon Q in Connect

• wisdom:CreateContentAssociation
• wisdom:DeleteContentAssociation
• wisdom:GetContentAssociation
• wisdom:ListContentAssociations

Amazon Connect

• connect:BatchGetAttachedFileMetadata
• connect:CompleteAttachedFileUpload
• connect:DeleteAttachedFile
• connect:GetAttachedFile
• connect:StartAttachedFileUpload

Amazon EventBridge

• events:UpdateEventBus

Amazon Connect Cases

• cases:DeleteRelatedItem

Amazon Q

• q:CreateAssignment
• q:DeleteAssignment

AWS Systems Manager for SAP

• ssm-sap:ListOperationEvents
• ssm-sap:StartApplication
• ssm-sap:StopApplication

AWS Mainframe Modernization Service

• m2:ListBatchJobRestartPoints

AWS Transfer Family

• transfer:StartDirectoryListing

Amazon VPC Lattice Services

• vpc-lattice-svcs:Connect

AWS Budget Service

• budgets:ListTagsForResource
• budgets:TagResource
• budgets:UntagResource

AWS Resilience Hub

• resiliencehub:ListAppAssessmentResourceDrifts

AWS Trusted Advisor

• trustedadvisor:BatchUpdateRecommendationResourceExclusion

Amazon Connect

• connect:AdminGetEmergencyAccessToken

Amazon Personalize

• personalize:CreateDataDeletionJob
• personalize:DescribeDataDeletionJob
• personalize:ListDataDeletionJobs

Amazon Pinpoint SMS Voice V2

• sms-voice:AssociateProtectConfiguration
• sms-voice:CreateProtectConfiguration
• sms-voice:DeleteAccountDefaultProtectConfiguration
• sms-voice:DeleteMediaMessageSpendLimitOverride
• sms-voice:DeleteProtectConfiguration
• sms-voice:DescribeProtectConfigurations
• sms-voice:DisassociateProtectConfiguration
• sms-voice:GetProtectConfigurationCountryRuleSet
• sms-voice:SendMediaMessage
• sms-voice:SetAccountDefaultProtectConfiguration
• sms-voice:SetMediaMessageSpendLimitOverride
• sms-voice:UpdateProtectConfiguration
• sms-voice:UpdateProtectConfigurationCountryRuleSet

Amazon Q Business

• qbusiness:CancelSubscription
• qbusiness:CreateSubscription
• qbusiness:ListSubscriptions
• qbusiness:UpdateSubscription

Amazon Timestream

• timestream:DescribeAccountSettings
• timestream:UpdateAccountSettings

Amazon Q Business Q Apps

• qapps:AssociateQAppWithUser
• qapps:CopyQApp
• qapps:CreateLibraryItem
• qapps:CreateLibraryItemReview
• qapps:CreateQApp
• qapps:CreateSubscriptionToken
• qapps:DeleteLibraryItem
• qapps:DeleteQApp
• qapps:DisassociateQAppFromUser
• qapps:GetLibraryItem
• qapps:GetQApp
• qapps:ImportDocumentToQApp
• qapps:ImportDocumentToQAppSession
• qapps:ListLibraryItems
• qapps:ListQApps
• qapps:PredictProblemStatementFromConversation
• qapps:PredictQAppFromProblemStatement
• qapps:StartQAppSession
• qapps:StopQAppSession
• qapps:UpdateLibraryItem
• qapps:UpdateQApp

AWS CodePipeline

• codepipeline:RollbackStage

AWS HealthLake

• healthlake:SearchEverything

AWS App Mesh Preview

• appmesh-preview:DeleteMeshPolicy
• appmesh-preview:GetMeshPolicy
• appmesh-preview:PutMeshPolicy

Amazon Connect Cases

• cases:DeleteField
• cases:DeleteLayout
• cases:DeleteTemplate

Amazon GameLift

• gamelift:CreateContainerGroupDefinition
• gamelift:DeleteContainerGroupDefinition
• gamelift:DescribeContainerGroupDefinition
• gamelift:ListContainerGroupDefinitions

Amazon QuickSight

• quicksight:UpdateSPICECapacityConfiguration

AWS Step Functions

• states:ValidateStateMachineDefinition

Amazon WorkDocs

• workdocs:DescribeInstanceExports
• workdocs:StartInstanceExport

AWS Signin

• signin:CreateTrustedIdentityPropagationApplicationForConsole
• signin:ListTrustedIdentityPropagationApplicationsForConsole

Amazon Bedrock

• bedrock:ApplyGuardrail
• bedrock:CreateEvaluationJob
• bedrock:GetEvaluationJob
• bedrock:ListEvaluationJobs
• bedrock:StopEvaluationJob

AWS Identity and Access Management Roles Anywhere

• rolesanywhere:DeleteAttributeMapping
• rolesanywhere:PutAttributeMapping

Amazon Route 53 Profiles enables sharing DNS settings with VPCs

• route53profiles:AssociateProfile
• route53profiles:AssociateResourceToProfile
• route53profiles:CreateProfile
• route53profiles:DeleteProfile
• route53profiles:DisassociateProfile
• route53profiles:DisassociateResourceFromProfile
• route53profiles:GetProfile
• route53profiles:GetProfileAssociation
• route53profiles:GetProfileResourceAssociation
• route53profiles:ListProfileAssociations
• route53profiles:ListProfileResourceAssociations
• route53profiles:ListProfiles
• route53profiles:ListTagsForResource
• route53profiles:TagResource
• route53profiles:UntagResource
• route53profiles:UpdateProfileResourceAssociation

AWS App Mesh

• appmesh:DeleteMeshPolicy
• appmesh:GetMeshPolicy
• appmesh:PutMeshPolicy

Amazon Q

• q:GetIdentityMetadata
• q:PassRequest
• q:UpdateTroubleshootingCommandResult

Amazon WorkSpaces

• workspaces:AcceptAccountLinkInvitation
• workspaces:CreateAccountLinkInvitation
• workspaces:DeleteAccountLinkInvitation
• workspaces:GetAccountLink
• workspaces:ListAccountLinks
• workspaces:RejectAccountLinkInvitation

Amazon CloudWatch Internet Monitor

• internetmonitor:GetInternetEvent
• internetmonitor:ListInternetEvents

Amazon EMR on EKS (EMR Containers)

• emr-containers:CreateSecurityConfiguration
• emr-containers:DescribeSecurityConfiguration
• emr-containers:ListSecurityConfigurations

AWS Outposts

• outposts:CancelCapacityTask
• outposts:GetCapacityTask
• outposts:GetOutpostSupportedInstanceTypes
• outposts:ListCapacityTasks
• outposts:StartCapacityTask

AWS Key Management Service

• kms:ListKeyRotations
• kms:RotateKeyOnDemand

AWS Well-Architected Tool

• wellarchitected:ConfigureIntegration
• wellarchitected:GetGlobalSettings
• wellarchitected:UpdateIntegration

AWS Glue

• glue:BatchGetStageFiles
• glue:GetEnvironment
• glue:GetExecutors
• glue:GetExecutorsThreads
• glue:GetLogParsingStatus
• glue:GetQueries
• glue:GetQuery
• glue:GetStage
• glue:GetStageAttempt
• glue:GetStageAttemptTaskList
• glue:GetStageAttemptTaskSummary
• glue:GetStageFiles
• glue:GetStages
• glue:GetStorage
• glue:GetStorageUnit
• glue:RequestLogParsing

AWS Elemental MediaLive

• medialive:CreateCloudWatchAlarmTemplate
• medialive:CreateCloudWatchAlarmTemplateGroup
• medialive:CreateEventBridgeRuleTemplate
• medialive:CreateEventBridgeRuleTemplateGroup
• medialive:CreateSignalMap
• medialive:DeleteCloudWatchAlarmTemplate
• medialive:DeleteCloudWatchAlarmTemplateGroup
• medialive:DeleteEventBridgeRuleTemplate
• medialive:DeleteEventBridgeRuleTemplateGroup
• medialive:DeleteSignalMap
• medialive:GetCloudWatchAlarmTemplate
• medialive:GetCloudWatchAlarmTemplateGroup
• medialive:GetEventBridgeRuleTemplate
• medialive:GetEventBridgeRuleTemplateGroup
• medialive:GetSignalMap
• medialive:ListCloudWatchAlarmTemplateGroups
• medialive:ListCloudWatchAlarmTemplates
• medialive:ListEventBridgeRuleTemplateGroups
• medialive:ListEventBridgeRuleTemplates
• medialive:ListSignalMaps
• medialive:StartDeleteMonitorDeployment
• medialive:StartMonitorDeployment
• medialive:StartUpdateSignalMap
• medialive:UpdateCloudWatchAlarmTemplate
• medialive:UpdateCloudWatchAlarmTemplateGroup
• medialive:UpdateEventBridgeRuleTemplate
• medialive:UpdateEventBridgeRuleTemplateGroup

Amazon Q in Connect

• wisdom:UpdateSession

AWS Supply Chain

• scn:SendDataIntegrationEvent

Amazon DataZone

• datazone:AddPolicyGrant
• datazone:ListPolicyGrants
• datazone:RemovePolicyGrant
• datazone:UpdateDataSourceRunActivities

AWS Control Catalog

• controlcatalog:ListCommonControls
• controlcatalog:ListDomains
• controlcatalog:ListObjectives

Amazon Neptune Analytics

• neptune-graph:StartImportTask

AWS Clean Rooms

• cleanrooms:BatchGetSchemaAnalysisRule

Amazon RDS

• rds:ModifyIntegration

Amazon DocumentDB Elastic Clusters

• docdb-elastic:CopyClusterSnapshot
• docdb-elastic:StartCluster
• docdb-elastic:StopCluster

AWS Entity Resolution

• entityresolution:AddPolicyStatement
• entityresolution:CreateIdNamespace
• entityresolution:DeleteIdNamespace
• entityresolution:DeletePolicyStatement
• entityresolution:GetIdNamespace
• entityresolution:GetPolicy
• entityresolution:ListIdNamespaces
• entityresolution:PutPolicy
• entityresolution:UpdateIdNamespace
• entityresolution:UseIdNamespace

AWS Marketplace Catalog

• aws-marketplace:DescribeAssessment
• aws-marketplace:ListAssessments

AWS CloudFormation

• cloudformation:ListStackSetAutoDeploymentTargets

Amazon DataZone

• datazone:DeleteTimeSeriesDataPoints
• datazone:GetTimeSeriesDataPoint
• datazone:ListTimeSeriesDataPoints
• datazone:PostTimeSeriesDataPoints

AWS IoT Wireless

• iotwireless:GetMetricConfiguration
• iotwireless:GetMetrics
• iotwireless:UpdateMetricConfiguration

AWS CodeConnections

• codeconnections:CreateConnection
• codeconnections:CreateHost
• codeconnections:CreateRepositoryLink
• codeconnections:CreateSyncConfiguration
• codeconnections:DeleteConnection
• codeconnections:DeleteHost
• codeconnections:DeleteRepositoryLink
• codeconnections:DeleteSyncConfiguration
• codeconnections:GetConnection
• codeconnections:GetHost
• codeconnections:GetIndividualAccessToken
• codeconnections:GetInstallationUrl
• codeconnections:GetRepositoryLink
• codeconnections:GetRepositorySyncStatus
• codeconnections:GetResourceSyncStatus
• codeconnections:GetSyncBlockerSummary
• codeconnections:GetSyncConfiguration
• codeconnections:ListConnections
• codeconnections:ListHosts
• codeconnections:ListInstallationTargets
• codeconnections:ListRepositoryLinks
• codeconnections:ListRepositorySyncDefinitions
• codeconnections:ListSyncConfigurations
• codeconnections:ListTagsForResource
• codeconnections:PassConnection
• codeconnections:PassRepository
• codeconnections:RegisterAppCode
• codeconnections:StartAppRegistrationHandshake
• codeconnections:StartOAuthHandshake
• codeconnections:TagResource
• codeconnections:UntagResource
• codeconnections:UpdateConnectionInstallation
• codeconnections:UpdateHost
• codeconnections:UpdateRepositoryLink
• codeconnections:UpdateSyncBlocker
• codeconnections:UpdateSyncConfiguration
• codeconnections:UseConnection

AWS Deadline Cloud

• deadline:AssociateMemberToFarm
• deadline:AssociateMemberToFleet
• deadline:AssociateMemberToJob
• deadline:AssociateMemberToQueue
• deadline:AssumeFleetRoleForRead
• deadline:AssumeFleetRoleForWorker
• deadline:AssumeQueueRoleForRead
• deadline:AssumeQueueRoleForUser
• deadline:AssumeQueueRoleForWorker
• deadline:BatchGetJobEntity
• deadline:CopyJobTemplate
• deadline:CreateBudget
• deadline:CreateFarm
• deadline:CreateFleet
• deadline:CreateJob
• deadline:CreateLicenseEndpoint
• deadline:CreateMonitor
• deadline:CreateQueue
• deadline:CreateQueueEnvironment
• deadline:CreateQueueFleetAssociation
• deadline:CreateStorageProfile
• deadline:CreateWorker
• deadline:DeleteBudget
• deadline:DeleteFarm
• deadline:DeleteFleet
• deadline:DeleteLicenseEndpoint
• deadline:DeleteMeteredProduct
• deadline:DeleteMonitor
• deadline:DeleteQueue
• deadline:DeleteQueueEnvironment
• deadline:DeleteQueueFleetAssociation
• deadline:DeleteStorageProfile
• deadline:DeleteWorker
• deadline:DisassociateMemberFromFarm
• deadline:DisassociateMemberFromFleet
• deadline:DisassociateMemberFromJob
• deadline:DisassociateMemberFromQueue
• deadline:GetApplicationVersion
• deadline:GetBudget
• deadline:GetFarm
• deadline:GetFleet
• deadline:GetJob
• deadline:GetLicenseEndpoint
• deadline:GetMonitor
• deadline:GetQueue
• deadline:GetQueueEnvironment
• deadline:GetQueueFleetAssociation
• deadline:GetSession
• deadline:GetSessionAction
• deadline:GetSessionsStatisticsAggregation
• deadline:GetStep
• deadline:GetStorageProfile
• deadline:GetStorageProfileForQueue
• deadline:GetTask
• deadline:GetWorker
• deadline:ListAvailableMeteredProducts
• deadline:ListBudgets
• deadline:ListFarmMembers
• deadline:ListFarms
• deadline:ListFleetMembers
• deadline:ListFleets
• deadline:ListJobMembers
• deadline:ListJobs
• deadline:ListLicenseEndpoints
• deadline:ListMeteredProducts
• deadline:ListMonitors
• deadline:ListQueueEnvironments
• deadline:ListQueueFleetAssociations
• deadline:ListQueueMembers
• deadline:ListQueues
• deadline:ListSessionActions
• deadline:ListSessions
• deadline:ListSessionsForWorker
• deadline:ListStepConsumers
• deadline:ListStepDependencies
• deadline:ListSteps
• deadline:ListStorageProfiles
• deadline:ListStorageProfilesForQueue
• deadline:ListTagsForResource
• deadline:ListTasks
• deadline:ListWorkers
• deadline:PutMeteredProduct
• deadline:SearchJobs
• deadline:SearchSteps
• deadline:SearchTasks
• deadline:SearchWorkers
• deadline:StartSessionsStatisticsAggregation
• deadline:TagResource
• deadline:UntagResource
• deadline:UpdateBudget
• deadline:UpdateFarm
• deadline:UpdateFleet
• deadline:UpdateJob
• deadline:UpdateMonitor
• deadline:UpdateQueue
• deadline:UpdateQueueEnvironment
• deadline:UpdateQueueFleetAssociation
• deadline:UpdateSession
• deadline:UpdateStep
• deadline:UpdateStorageProfile
• deadline:UpdateTask
• deadline:UpdateWorker
• deadline:UpdateWorkerSchedule

Amazon SageMaker

• sagemaker:DeleteResourcePolicy
• sagemaker:GetResourcePolicy
• sagemaker:PutResourcePolicy

Amazon GroundTruth Labeling

• groundtruthlabeling:CreateBatch
• groundtruthlabeling:CreateIntakeForm
• groundtruthlabeling:CreateProject
• groundtruthlabeling:CreateWorkflowDefinition
• groundtruthlabeling:GenerateLIDARPreviewTaskConfigJob
• groundtruthlabeling:GetBatch
• groundtruthlabeling:GetIntakeFormStatus
• groundtruthlabeling:ListBatches
• groundtruthlabeling:ListProjects
• groundtruthlabeling:RunGenerateManifestMetricsJob
• groundtruthlabeling:UpdateBatch

Amazon EC2

• ec2:DescribeMacHosts
• ec2:GetInstanceMetadataDefaults
• ec2:ModifyInstanceMetadataDefaults

Amazon FinSpace

• finspace:DeleteKxClusterNode

AWS Cost Explorer Service

• ce:ListCostAllocationTagBackfillHistory
• ce:StartCostAllocationTagBackfill

AWS Migration Hub Orchestrator

• migrationhub-orchestrator:CreateTemplate
• migrationhub-orchestrator:DeleteTemplate
• migrationhub-orchestrator:UpdateTemplate

AWS Savings Plans

• savingsplans:ReturnSavingsPlan

Amazon CloudWatch Internet Monitor

• internetmonitor:Link

AWS CodeArtifact

• codeartifact:CreatePackageGroup
• codeartifact:DeletePackageGroup
• codeartifact:DescribePackageGroup
• codeartifact:GetAssociatedPackageGroup
• codeartifact:ListAllowedRepositoriesForGroup
• codeartifact:ListAssociatedPackages
• codeartifact:ListPackageGroups
• codeartifact:ListSubPackageGroups
• codeartifact:UpdatePackageGroup
• codeartifact:UpdatePackageGroupOriginConfiguration

Amazon DynamoDB

• dynamodb:DeleteResourcePolicy
• dynamodb:PutResourcePolicy
• dynamodb:UpdateKinesisStreamingDestination

Amazon WorkMail

• workmail:AllowVendedLogDeliveryForResource

Amazon Managed Blockchain Query

• managedblockchain-query:ListFilteredTransactionEvents

Amazon Timestream InfluxDB

• timestream-influxdb:CreateDbInstance
• timestream-influxdb:CreateDbParameterGroup
• timestream-influxdb:DeleteDbInstance
• timestream-influxdb:GetDbInstance
• timestream-influxdb:GetDbParameterGroup
• timestream-influxdb:ListDbInstances
• timestream-influxdb:ListDbParameterGroups
• timestream-influxdb:ListTagsForResource
• timestream-influxdb:TagResource
• timestream-influxdb:UntagResource
• timestream-influxdb:UpdateDbInstance

Amazon Timestream Influxdb

• timestream-influxdb:CreateDbInstance
• timestream-influxdb:CreateDbParameterGroup
• timestream-influxdb:DeleteDbInstance
• timestream-influxdb:GetDbInstance
• timestream-influxdb:GetDbParameterGroup
• timestream-influxdb:ListDbInstances
• timestream-influxdb:ListDbParameterGroups
• timestream-influxdb:ListTagsForResource
• timestream-influxdb:TagResource
• timestream-influxdb:UntagResource
• timestream-influxdb:UpdateDbInstance

Amazon Lightsail

• lightsail:GetSetupHistory
• lightsail:SetupInstanceHttps

Amazon DataZone

• datazone:CancelMetadataGenerationRun

AWS Migration Hub Strategy Recommendations

• migrationhub-strategy:PutLogData
• migrationhub-strategy:PutMetricData

Amazon Lex V2

• lex:CreateBotReplica
• lex:DeleteBotReplica
• lex:DescribeBotReplica
• lex:ListBotAliasReplicas
• lex:ListBotReplicas
• lex:ListBotVersionReplicas

Amazon Elastic MapReduce

• elasticmapreduce:SetUnhealthyNodeReplacement

AWS Identity Sync

• identity-sync:AllowVendedLogDeliveryForResource

Amazon Q

• q:ListConversations

Amazon Redshift

• redshift:CreateQev2IdcApplication
• redshift:DeleteQev2IdcApplication
• redshift:DescribeQev2IdcApplications
• redshift:ModifyQev2IdcApplication

AWS Amplify UI Builder

• amplifyuibuilder:ListTagsForResource
• amplifyuibuilder:TagResource
• amplifyuibuilder:UntagResource

Amazon Managed Streaming for Kafka Connect

• kafkaconnect:DeleteWorkerConfiguration
• kafkaconnect:ListTagsForResource
• kafkaconnect:TagResource
• kafkaconnect:UntagResource

AWS WAF V2

• wafv2:DeleteAPIKey

AWS Elemental MediaLive

• medialive:RestartChannelPipelines

AWS Resource Groups

• resource-groups:DeleteGroupPolicy
• resource-groups:GetGroupPolicy
• resource-groups:ListResourceTypes

Amazon Message Gateway Service

• ssmmessages:CreateControlChannel
• ssmmessages:CreateDataChannel
• ssmmessages:OpenControlChannel
• ssmmessages:OpenDataChannel

Amazon Bedrock

• bedrock:DetectGeneratedContent

AWS Control Tower

• controltower:DisableBaseline
• controltower:EnableBaseline
• controltower:GetBaseline
• controltower:GetBaselineOperation
• controltower:GetEnabledBaseline
• controltower:ListBaselines
• controltower:ListEnabledBaselines
• controltower:ResetEnabledBaseline
• controltower:UpdateEnabledBaseline

Amazon SageMaker

• sagemaker:UpdateClusterSoftware

AWS CloudFormation

• cloudformation:CreateGeneratedTemplate
• cloudformation:DeleteGeneratedTemplate
• cloudformation:DescribeGeneratedTemplate
• cloudformation:DescribeResourceScan
• cloudformation:GetGeneratedTemplate
• cloudformation:ListGeneratedTemplates
• cloudformation:ListResourceScanRelatedResources
• cloudformation:ListResourceScanResources
• cloudformation:ListResourceScans
• cloudformation:StartResourceScan
• cloudformation:UpdateGeneratedTemplate

AWS Database Migration Service

• dms:CreateTest
• dms:CreateTestEnvironments
• dms:CreateTestPlan
• dms:CreateTestRun
• dms:DeleteTest
• dms:DeleteTestPlan
• dms:DescribeTestEnvironments
• dms:DescribeTestGenerationStatus
• dms:DescribeTestPlans
• dms:DescribeTestRunResultsSummaries
• dms:DescribeTestRuns
• dms:DescribeTests
• dms:ModifyTest
• dms:ModifyTestPlan
• dms:StartGenerateTests
• dms:StopGenerateTests
• dms:StopTestRun
• dms:ViewTestRunResults

Amazon Redshift

• redshift:ListRecommendations

AWS Tax Settings

• tax:GetTaxInfoReportingDocument

AWS Billing

• billing:GetBillingData
• billing:GetBillingDetails
• billing:GetBillingNotifications
• billing:GetBillingPreferences
• billing:GetContractInformation
• billing:GetCredits
• billing:GetIAMAccessPreference
• billing:GetSellerOfRecord
• billing:ListBillingViews
• billing:PutContractInformation
• billing:RedeemCredits
• billing:UpdateBillingPreferences
• billing:UpdateIAMAccessPreference

AWS Billing Console

• aws-portal:GetConsoleActionSetEnforced
• aws-portal:ModifyAccount
• aws-portal:ModifyBilling
• aws-portal:ModifyPaymentMethods
• aws-portal:UpdateConsoleActionSetEnforced
• aws-portal:ViewAccount
• aws-portal:ViewBilling
• aws-portal:ViewPaymentMethods
• aws-portal:ViewUsage

Tag Editor

• resource-explorer:ListResourceTypes
• resource-explorer:ListResources
• resource-explorer:ListTags

AWS AppSync

• appsync:GetGraphqlApiEnvironmentVariables
• appsync:PutGraphqlApiEnvironmentVariables

AWS Billing And Cost Management Data Exports

• bcm-data-exports:CreateExport
• bcm-data-exports:DeleteExport
• bcm-data-exports:GetExecution
• bcm-data-exports:GetExport
• bcm-data-exports:GetTable
• bcm-data-exports:ListExecutions
• bcm-data-exports:ListExports
• bcm-data-exports:ListTables
• bcm-data-exports:ListTagsForResource
• bcm-data-exports:TagResource
• bcm-data-exports:UntagResource
• bcm-data-exports:UpdateExport

Amazon SageMaker

• sagemaker:DeleteHyperParameterTuningJob

AWS Billing and Cost Management And Cost Management Data Exports

• bcm-data-exports:CreateExport
• bcm-data-exports:DeleteExport
• bcm-data-exports:GetExecution
• bcm-data-exports:GetExport
• bcm-data-exports:GetTable
• bcm-data-exports:ListExecutions
• bcm-data-exports:ListExports
• bcm-data-exports:ListTables
• bcm-data-exports:ListTagsForResource
• bcm-data-exports:TagResource
• bcm-data-exports:UntagResource
• bcm-data-exports:UpdateExport

Amazon DataZone

• datazone:ListEnvironmentBlueprintConfigurationSummaries

Amazon Interactive Video Service

• ivs:CreatePlaybackRestrictionPolicy
• ivs:DeletePlaybackRestrictionPolicy
• ivs:GetPlaybackRestrictionPolicy
• ivs:ListPlaybackRestrictionPolicies
• ivs:UpdatePlaybackRestrictionPolicy

Amazon RDS

• rds:CreateDBShardGroup
• rds:DeleteDBShardGroup
• rds:DescribeDBShardGroups
• rds:ModifyDBShardGroup
• rds:RebootDBShardGroup

AWS Billing And Cost Management Data Exports

• bcm-data-exports:CreateExport
• bcm-data-exports:DeleteExport
• bcm-data-exports:GetExecution
• bcm-data-exports:GetExport
• bcm-data-exports:GetTable
• bcm-data-exports:ListExecutions
• bcm-data-exports:ListExports
• bcm-data-exports:ListTables
• bcm-data-exports:ListTagsForResource
• bcm-data-exports:TagResource
• bcm-data-exports:UntagResource
• bcm-data-exports:UpdateExport

AWS Elemental MediaConnect

• mediaconnect:DescribeFlowSourceMetadata

Amazon Inspector2

• inspector2:CreateCisScanConfiguration
• inspector2:DeleteCisScanConfiguration
• inspector2:GetCisScanReport
• inspector2:GetCisScanResultDetails
• inspector2:ListCisScanConfigurations
• inspector2:ListCisScanResultsAggregatedByChecks
• inspector2:ListCisScanResultsAggregatedByTargetResource
• inspector2:ListCisScans
• inspector2:SendCisSessionHealth
• inspector2:SendCisSessionTelemetry
• inspector2:StartCisSession
• inspector2:StopCisSession
• inspector2:UpdateCisScanConfiguration

AWS CodeBuild

• codebuild:BatchGetFleets
• codebuild:CreateFleet
• codebuild:DeleteFleet
• codebuild:ListFleets
• codebuild:UpdateFleet

Amazon Connect Cases

• cases:GetCaseAuditEvents

Amazon Elastic MapReduce

• elasticmapreduce:SetKeepJobFlowAliveWhenNoSteps

AWS Supply Chain

• scn:CreateBillOfMaterialsImportJob
• scn:GetBillOfMaterialsImportJob

AWS Lake Formation

• lakeformation:CreateLakeFormationIdentityCenterConfiguration
• lakeformation:DeleteLakeFormationIdentityCenterConfiguration
• lakeformation:DescribeLakeFormationIdentityCenterConfiguration
• lakeformation:UpdateLakeFormationIdentityCenterConfiguration

Amazon DynamoDB

• dynamodb:GetResourcePolicy

AWS IoT

• iot:CreateCertificateProvider
• iot:DeleteCertificateProvider
• iot:DescribeCertificateProvider
• iot:ListCertificateProviders
• iot:UpdateCertificateProvider

Amazon AppIntegrations

• app-integrations:CreateApplicationAssociation
• app-integrations:DeleteApplication
• app-integrations:DeleteApplicationAssociation
• app-integrations:ListApplicationAssociations

AWS CodeCommit

• codecommit:UpdateRepositoryEncryptionKey

Amazon Connect

• connect:AssociateUserProficiencies
• connect:DisassociateUserProficiencies
• connect:ListUserProficiencies
• connect:SearchContacts
• connect:SearchPredefinedAttributes
• connect:UpdateContactRoutingData
• connect:UpdateUserProficiencies

Amazon Elastic Kubernetes Service

• eks:DescribeInsight
• eks:ListInsights

Amazon GuardDuty

• guardduty:GetOrganizationStatistics

Amazon RDS

• rds:DescribeDBRecommendations
• rds:DisableHttpEndpoint
• rds:EnableHttpEndpoint
• rds:ModifyDBRecommendation

Amazon SageMaker

• sagemaker:DeleteCompilationJob

Amazon CloudWatch Network Monitor

• networkmonitor:CreateMonitor
• networkmonitor:CreateProbe
• networkmonitor:DeleteMonitor
• networkmonitor:DeleteProbe
• networkmonitor:GetMonitor
• networkmonitor:GetProbe
• networkmonitor:ListMonitors
• networkmonitor:ListTagsForResource
• networkmonitor:TagResource
• networkmonitor:UntagResource
• networkmonitor:UpdateMonitor
• networkmonitor:UpdateProbe

Amazon FSx

• fsx:DeleteResourcePolicy
• fsx:GetResourcePolicy
• fsx:PutResourcePolicy

Amazon QuickSight

• quicksight:UpdateDashboardLinks

Amazon Connect

• connect:PauseContact
• connect:ResumeContact
• connect:TagContact
• connect:UntagContact

Amazon Elastic Kubernetes Service

• eks:AssociateAccessPolicy
• eks:CreateAccessEntry
• eks:DeleteAccessEntry
• eks:DescribeAccessEntry
• eks:DisassociateAccessPolicy
• eks:ListAccessEntries
• eks:ListAccessPolicies
• eks:ListAssociatedAccessPolicies
• eks:UpdateAccessEntry

AWS Billing Conductor

• billingconductor:GetBillingGroupCostReport

Amazon EC2 Image Builder

• imagebuilder:CreateWorkflow
• imagebuilder:DeleteWorkflow
• imagebuilder:GetWorkflow
• imagebuilder:ListWaitingWorkflowSteps
• imagebuilder:ListWorkflowBuildVersions
• imagebuilder:ListWorkflows
• imagebuilder:SendWorkflowStepAction

Amazon Monitron

• monitron:CreateProjectUserAssociation
• monitron:CreateUserAccessRoleAssociation
• monitron:DeleteProjectUserAssociation
• monitron:DeleteUserAccessRoleAssociation
• monitron:ListProjectUserAssociations
• monitron:ListUserAccessRoleAssociations

Amazon Lex V2

• lex:DescribeBotResourceGeneration
• lex:GenerateBotElement
• lex:ListBotResourceGenerations
• lex:StartBotResourceGeneration

AWS Cost and Usage Report

• cur:ListTagsForResource
• cur:TagResource
• cur:UntagResource

Amazon FinSpace

• finspace:CreateKxDataview
• finspace:CreateKxScalingGroup
• finspace:CreateKxVolume
• finspace:DeleteKxDataview
• finspace:DeleteKxScalingGroup
• finspace:DeleteKxVolume
• finspace:GetKxDataview
• finspace:GetKxScalingGroup
• finspace:GetKxVolume
• finspace:ListKxDataviews
• finspace:ListKxScalingGroups
• finspace:ListKxVolumes
• finspace:UpdateKxDataview
• finspace:UpdateKxVolume

Amazon Athena

• athena:CancelQueryExecution
• athena:GetCatalogs
• athena:GetExecutionEngine
• athena:GetExecutionEngines
• athena:GetNamespace
• athena:GetNamespaces
• athena:GetQueryExecutions
• athena:GetTable
• athena:GetTables
• athena:RunQuery

Amazon CloudFront

• cloudfront:CreateKeyValueStore
• cloudfront:DeleteKeyValueStore
• cloudfront:DescribeKeyValueStore
• cloudfront:ListKeyValueStores
• cloudfront:UpdateKeyValueStore

Amazon Connect

• connect:CreatePersistentContactAssociation

AWS Glue

• glue:BatchGetTableOptimizer
• glue:CreateTableOptimizer
• glue:DeleteTableOptimizer
• glue:GetColumnStatisticsTaskRun
• glue:GetColumnStatisticsTaskRuns
• glue:GetTableOptimizer
• glue:ListColumnStatisticsTaskRuns
• glue:ListTableOptimizerRuns
• glue:PassConnection
• glue:StartColumnStatisticsTaskRun
• glue:StopColumnStatisticsTaskRun
• glue:UpdateTableOptimizer

Amazon QuickSight

• quicksight:DeleteIdentityPropagationConfig
• quicksight:ListIdentityPropagationConfigs
• quicksight:UpdateIdentityPropagationConfig

AWS Fault Injection Service

• fis:CreateExperimentTemplate
• fis:CreateTargetAccountConfiguration
• fis:DeleteExperimentTemplate
• fis:DeleteTargetAccountConfiguration
• fis:GetAction
• fis:GetExperiment
• fis:GetExperimentTargetAccountConfiguration
• fis:GetExperimentTemplate
• fis:GetTargetAccountConfiguration
• fis:GetTargetResourceType
• fis:InjectApiInternalError
• fis:InjectApiThrottleError
• fis:InjectApiUnavailableError
• fis:ListActions
• fis:ListExperimentResolvedTargets
• fis:ListExperimentTargetAccountConfigurations
• fis:ListExperimentTemplates
• fis:ListExperiments
• fis:ListTagsForResource
• fis:ListTargetAccountConfigurations
• fis:ListTargetResourceTypes
• fis:StartExperiment
• fis:StopExperiment
• fis:TagResource
• fis:UntagResource
• fis:UpdateExperimentTemplate
• fis:UpdateTargetAccountConfiguration

AWS Application Transformation Service

• application-transformation:GetContainerization
• application-transformation:GetDeployment
• application-transformation:StartContainerization
• application-transformation:StartDeployment

AWS AppSync

• appsync:GetDataSourceIntrospection
• appsync:StartDataSourceIntrospection

AWS Backup

• backup:CreateRestoreTestingPlan
• backup:CreateRestoreTestingSelection
• backup:DeleteRestoreTestingPlan
• backup:DeleteRestoreTestingSelection
• backup:GetRestoreJobMetadata
• backup:GetRestoreTestingInferredMetadata
• backup:GetRestoreTestingPlan
• backup:GetRestoreTestingSelection
• backup:ListRestoreJobsByProtectedResource
• backup:ListRestoreTestingPlans
• backup:ListRestoreTestingSelections
• backup:PutRestoreValidationResult
• backup:UpdateRestoreTestingPlan
• backup:UpdateRestoreTestingSelection

Amazon Bedrock

• bedrock:CreateGuardrail
• bedrock:CreateGuardrailVersion
• bedrock:CreateModelEvaluationJob
• bedrock:CreateModelInvocationJob
• bedrock:DeleteAgent
• bedrock:DeleteAgentActionGroup
• bedrock:DeleteAgentAlias
• bedrock:DeleteAgentVersion
• bedrock:DeleteGuardrail
• bedrock:GetGuardrail
• bedrock:GetModelEvaluationJob
• bedrock:GetModelInvocationJob
• bedrock:ListGuardrails
• bedrock:ListModelEvaluationJobs
• bedrock:ListModelInvocationJobs
• bedrock:PrepareAgent
• bedrock:Retrieve
• bedrock:RetrieveAndGenerate
• bedrock:StopModelInvocationJob
• bedrock:UpdateGuardrail

AWS Clean Rooms

• cleanrooms:CreateConfiguredAudienceModelAssociation
• cleanrooms:CreatePrivacyBudgetTemplate
• cleanrooms:DeleteConfiguredAudienceModelAssociation
• cleanrooms:DeletePrivacyBudgetTemplate
• cleanrooms:GetCollaborationConfiguredAudienceModelAssociation
• cleanrooms:GetCollaborationPrivacyBudgetTemplate
• cleanrooms:GetConfiguredAudienceModelAssociation
• cleanrooms:GetPrivacyBudgetTemplate
• cleanrooms:ListCollaborationConfiguredAudienceModelAssociations
• cleanrooms:ListCollaborationPrivacyBudgetTemplates
• cleanrooms:ListCollaborationPrivacyBudgets
• cleanrooms:ListConfiguredAudienceModelAssociations
• cleanrooms:ListPrivacyBudgetTemplates
• cleanrooms:ListPrivacyBudgets
• cleanrooms:PreviewPrivacyImpact
• cleanrooms:UpdateConfiguredAudienceModelAssociation
• cleanrooms:UpdatePrivacyBudgetTemplate

AWS CloudTrail

• cloudtrail:DisableFederation
• cloudtrail:EnableFederation
• cloudtrail:GetEventDataStoreData

Amazon CloudWatch

• cloudwatch:BatchGetServiceLevelIndicatorReport
• cloudwatch:BatchGetServiceLevelObjectiveBudgetReport
• cloudwatch:CreateServiceLevelObjective
• cloudwatch:DeleteServiceLevelObjective
• cloudwatch:EnableTopologyDiscovery
• cloudwatch:GenerateQuery
• cloudwatch:GetService
• cloudwatch:GetServiceData
• cloudwatch:GetServiceLevelObjective
• cloudwatch:GetTopologyDiscoveryStatus
• cloudwatch:GetTopologyMap
• cloudwatch:ListServiceLevelObjectives
• cloudwatch:ListServices
• cloudwatch:UpdateServiceLevelObjective

Amazon CloudWatch Logs

• logs:CreateLogAnomalyDetector
• logs:DeleteLogAnomalyDetector
• logs:GetLogAnomalyDetector
• logs:ListAnomalies
• logs:ListLogAnomalyDetectors
• logs:UpdateAnomaly
• logs:UpdateLogAnomalyDetector

Amazon CodeCatalyst

• codecatalyst:AssociateIdentityCenterApplicationToSpace
• codecatalyst:AssociateIdentityToIdentityCenterApplication
• codecatalyst:BatchAssociateIdentitiesToIdentityCenterApplication
• codecatalyst:BatchDisassociateIdentitiesFromIdentityCenterApplication
• codecatalyst:CreateIdentityCenterApplication
• codecatalyst:CreateSpace
• codecatalyst:CreateSpaceAdminRoleAssignment
• codecatalyst:DeleteIdentityCenterApplication
• codecatalyst:DisassociateIdentityCenterApplicationFromSpace
• codecatalyst:DisassociateIdentityFromIdentityCenterApplication
• codecatalyst:GetIdentityCenterApplication
• codecatalyst:ListIdentityCenterApplications
• codecatalyst:ListIdentityCenterApplicationsForSpace
• codecatalyst:ListSpacesForIdentityCenterApplication
• codecatalyst:SynchronizeIdentityCenterApplication
• codecatalyst:UpdateIdentityCenterApplication

AWS CodeStar Connections

• codestar-connections:CreateRepositoryLink
• codestar-connections:CreateSyncConfiguration
• codestar-connections:DeleteRepositoryLink
• codestar-connections:DeleteSyncConfiguration
• codestar-connections:GetRepositoryLink
• codestar-connections:GetRepositorySyncStatus
• codestar-connections:GetResourceSyncStatus
• codestar-connections:GetSyncBlockerSummary
• codestar-connections:GetSyncConfiguration
• codestar-connections:ListRepositoryLinks
• codestar-connections:ListRepositorySyncDefinitions
• codestar-connections:ListSyncConfigurations
• codestar-connections:PassRepository
• codestar-connections:UpdateRepositoryLink
• codestar-connections:UpdateSyncBlocker
• codestar-connections:UpdateSyncConfiguration

Amazon CodeWhisperer

• codewhisperer:ListCustomizationVersions

Amazon Connect

• connect:AssociateFlow
• connect:DisassociateFlow
• connect:GetFlowAssociation
• connect:ImportPhoneNumber
• connect:ListFlowAssociations
• connect:ListRealtimeContactAnalysisSegmentsV2
• connect:SendChatIntegrationEvent
• connect:StartWebRTCContact

Amazon Connect Customer Profiles

• profile:DetectProfileObjectType

AWS Control Tower

• controltower:CreateLandingZone
• controltower:GetLandingZone
• controltower:GetLandingZoneOperation
• controltower:ListLandingZones
• controltower:ResetLandingZone
• controltower:UpdateEnabledControl
• controltower:UpdateLandingZone

Amazon DataZone

• datazone:GetMetadataGenerationRun
• datazone:ListMetadataGenerationRuns
• datazone:StartMetadataGenerationRun
• datazone:StopMetadataGenerationRun

Amazon Detective

• detective:GetInvestigation
• detective:InvokeAssistant
• detective:ListIndicators
• detective:ListInvestigations
• detective:StartInvestigation
• detective:UpdateInvestigationState

Amazon EC2

• ec2:AssociateIpamByoasn
• ec2:DeprovisionIpamByoasn
• ec2:DescribeCapacityBlockOfferings
• ec2:DescribeInstanceTopology
• ec2:DescribeIpamByoasn
• ec2:DescribeLockedSnapshots
• ec2:DisableSnapshotBlockPublicAccess
• ec2:DisassociateIpamByoasn
• ec2:EnableSnapshotBlockPublicAccess
• ec2:GetIpamDiscoveredPublicAddresses
• ec2:GetSnapshotBlockPublicAccessState
• ec2:LockSnapshot
• ec2:ProvisionIpamByoasn
• ec2:PurchaseCapacityBlock
• ec2:UnlockSnapshot

Amazon EC2 Image Builder

• imagebuilder:CancelLifecycleExecution
• imagebuilder:CreateLifecyclePolicy
• imagebuilder:DeleteLifecyclePolicy
• imagebuilder:GetLifecycleExecution
• imagebuilder:GetLifecyclePolicy
• imagebuilder:ListLifecycleExecutionResources
• imagebuilder:ListLifecycleExecutions
• imagebuilder:ListLifecyclePolicies
• imagebuilder:StartResourceStateUpdate
• imagebuilder:UpdateLifecyclePolicy

Amazon Elastic Container Registry

• ecr:CreateRepositoryCreationTemplate
• ecr:DeleteRepositoryCreationTemplate
• ecr:DescribeRepositoryCreationTemplate
• ecr:UpdatePullThroughCacheRule
• ecr:ValidatePullThroughCacheRule

Amazon Elastic File System

• elasticfilesystem:UpdateFileSystemProtection

Amazon Elastic Kubernetes Service

• eks:CreatePodIdentityAssociation
• eks:DeletePodIdentityAssociation
• eks:DescribePodIdentityAssociation
• eks:ListPodIdentityAssociations
• eks:UpdatePodIdentityAssociation

AWS Elastic Load Balancing V2

• elasticloadbalancing:AddTrustStoreRevocations
• elasticloadbalancing:CreateTrustStore
• elasticloadbalancing:DeleteTrustStore
• elasticloadbalancing:DescribeTrustStoreAssociations
• elasticloadbalancing:DescribeTrustStoreRevocations
• elasticloadbalancing:DescribeTrustStores
• elasticloadbalancing:GetTrustStoreCaCertificatesBundle
• elasticloadbalancing:GetTrustStoreRevocationContent
• elasticloadbalancing:ModifyTrustStore
• elasticloadbalancing:RemoveTrustStoreRevocations

Amazon ElastiCache

• elasticache:CopyServerlessCacheSnapshot
• elasticache:CreateServerlessCache
• elasticache:CreateServerlessCacheSnapshot
• elasticache:DeleteServerlessCache
• elasticache:DeleteServerlessCacheSnapshot
• elasticache:DescribeServerlessCacheSnapshots
• elasticache:DescribeServerlessCaches
• elasticache:ExportServerlessCacheSnapshot
• elasticache:InterruptClusterAzPower
• elasticache:ModifyServerlessCache

Amazon EventBridge

• events:RetrieveConnectionCredentials

Amazon FSx

• fsx:CopySnapshotAndUpdateVolume
• fsx:DescribeSharedVpcConfiguration
• fsx:UpdateSharedVpcConfiguration

AWS Glue

• glue:GetCompletion
• glue:SendFeedback
• glue:StartCompletion

AWS IAM Access Analyzer

• access-analyzer:CheckAccessNotGranted
• access-analyzer:CheckNoNewAccess
• access-analyzer:GetFindingsStatistics

AWS IAM Identity Center (successor to AWS Single Sign-On)

• sso:CreateApplication
• sso:CreateApplicationAssignment
• sso:CreateInstance
• sso:CreateTrustedTokenIssuer
• sso:DeleteApplication
• sso:DeleteApplicationAccessScope
• sso:DeleteApplicationAssignment
• sso:DeleteApplicationAuthenticationMethod
• sso:DeleteApplicationGrant
• sso:DeleteInstance
• sso:DeleteTrustedTokenIssuer
• sso:DescribeApplication
• sso:DescribeApplicationAssignment
• sso:DescribeApplicationProvider
• sso:DescribeInstance
• sso:DescribeTrustedTokenIssuer
• sso:GetApplicationAccessScope
• sso:GetApplicationAssignmentConfiguration
• sso:GetApplicationAuthenticationMethod
• sso:GetApplicationGrant
• sso:ListAccountAssignmentsForPrincipal
• sso:ListApplicationAccessScopes
• sso:ListApplicationAssignments
• sso:ListApplicationAssignmentsForPrincipal
• sso:ListApplicationAuthenticationMethods
• sso:ListApplicationGrants
• sso:ListApplicationProviders
• sso:ListTrustedTokenIssuers
• sso:PutApplicationAccessScope
• sso:PutApplicationAuthenticationMethod
• sso:PutApplicationGrant
• sso:UpdateApplication
• sso:UpdateInstance
• sso:UpdateTrustedTokenIssuer

Amazon Interactive Video Service

• ivs:CreateEncoderConfiguration
• ivs:CreateStorageConfiguration
• ivs:DeleteEncoderConfiguration
• ivs:DeleteStorageConfiguration
• ivs:GetComposition
• ivs:GetEncoderConfiguration
• ivs:GetStorageConfiguration
• ivs:ListCompositions
• ivs:ListEncoderConfigurations
• ivs:ListStorageConfigurations
• ivs:StartComposition
• ivs:StopComposition

AWS IoT SiteWise

• iotsitewise:CreateAssetModelCompositeModel
• iotsitewise:DeleteAssetModelCompositeModel
• iotsitewise:DescribeAction
• iotsitewise:DescribeAssetCompositeModel
• iotsitewise:DescribeAssetModelCompositeModel
• iotsitewise:EnableSiteWiseIntegration
• iotsitewise:ExecuteAction
• iotsitewise:ExecuteQuery
• iotsitewise:ListActions
• iotsitewise:ListAssetModelCompositeModels
• iotsitewise:ListCompositionRelationships
• iotsitewise:UpdateAssetModelCompositeModel

AWS IoT TwinMaker

• iottwinmaker:CancelMetadataTransferJob
• iottwinmaker:CreateMetadataTransferJob
• iottwinmaker:GetMetadataTransferJob
• iottwinmaker:ListComponents
• iottwinmaker:ListMetadataTransferJobs
• iottwinmaker:ListProperties

Amazon Kinesis Data Streams

• kinesis:DeleteResourcePolicy
• kinesis:GetResourcePolicy
• kinesis:PutResourcePolicy

Amazon Managed Blockchain

• managedblockchain:InvokeRpcPolygonMainnet
• managedblockchain:InvokeRpcPolygonMumbaiTestnet

Amazon Managed Service for Prometheus

• aps:CreateScraper
• aps:DeleteScraper
• aps:DescribeScraper
• aps:GetDefaultScraperConfiguration
• aps:ListScrapers

Amazon OpenSearch Service

• es:AddDataSource
• es:CancelDomainConfigChange
• es:DeleteDataSource
• es:GetDataSource
• es:ListDataSources
• es:UpdateDataSource

Amazon Personalize

• personalize:GetActionRecommendations
• personalize:PutActionInteractions
• personalize:PutActions

Amazon Pinpoint SMS Voice V2

• sms-voice:CreateRegistration
• sms-voice:CreateRegistrationAssociation
• sms-voice:CreateRegistrationAttachment
• sms-voice:CreateRegistrationVersion
• sms-voice:CreateVerifiedDestinationNumber
• sms-voice:DeleteRegistration
• sms-voice:DeleteRegistrationAttachment
• sms-voice:DeleteRegistrationFieldValue
• sms-voice:DeleteVerifiedDestinationNumber
• sms-voice:DescribeRegistrationAttachments
• sms-voice:DescribeRegistrationFieldDefinitions
• sms-voice:DescribeRegistrationFieldValues
• sms-voice:DescribeRegistrationSectionDefinitions
• sms-voice:DescribeRegistrationTypeDefinitions
• sms-voice:DescribeRegistrationVersions
• sms-voice:DescribeRegistrations
• sms-voice:DescribeVerifiedDestinationNumbers
• sms-voice:DiscardRegistrationVersion
• sms-voice:ListRegistrationAssociations
• sms-voice:PutRegistrationFieldValue
• sms-voice:ReleaseSenderId
• sms-voice:RequestSenderId
• sms-voice:SendDestinationNumberVerificationCode
• sms-voice:SubmitRegistrationVersion
• sms-voice:UpdateSenderId
• sms-voice:VerifyDestinationNumber

Amazon QuickSight

• quicksight:CreateRoleMembership
• quicksight:DeleteRoleCustomPermission
• quicksight:DeleteRoleMembership
• quicksight:DescribeRoleCustomPermission
• quicksight:ListRoleMemberships
• quicksight:UpdateRoleCustomPermission

Amazon Redshift

• redshift:CreateRedshiftIdcApplication
• redshift:DeleteRedshiftIdcApplication
• redshift:DescribeRedshiftIdcApplications
• redshift:ModifyRedshiftIdcApplication

Amazon Redshift Serverless

• redshift-serverless:CreateScheduledAction
• redshift-serverless:CreateSnapshotCopyConfiguration
• redshift-serverless:DeleteScheduledAction
• redshift-serverless:DeleteSnapshotCopyConfiguration
• redshift-serverless:GetScheduledAction
• redshift-serverless:ListScheduledActions
• redshift-serverless:ListSnapshotCopyConfigurations
• redshift-serverless:RestoreTableFromRecoveryPoint
• redshift-serverless:UpdateScheduledAction
• redshift-serverless:UpdateSnapshotCopyConfiguration

Amazon Route 53 Application Recovery Controller - Zonal Shift

• arc-zonal-shift:CreatePracticeRunConfiguration
• arc-zonal-shift:DeletePracticeRunConfiguration
• arc-zonal-shift:ListAutoshifts
• arc-zonal-shift:UpdatePracticeRunConfiguration
• arc-zonal-shift:UpdateZonalAutoshiftConfiguration

Amazon S3

• s3:AssociateAccessGrantsIdentityCenter
• s3:CreateAccessGrant
• s3:CreateAccessGrantsInstance
• s3:CreateAccessGrantsLocation
• s3:DeleteAccessGrant
• s3:DeleteAccessGrantsInstance
• s3:DeleteAccessGrantsInstanceResourcePolicy
• s3:DeleteAccessGrantsLocation
• s3:DissociateAccessGrantsIdentityCenter
• s3:GetAccessGrant
• s3:GetAccessGrantsInstance
• s3:GetAccessGrantsInstanceForPrefix
• s3:GetAccessGrantsInstanceResourcePolicy
• s3:GetAccessGrantsLocation
• s3:GetDataAccess
• s3:ListAccessGrants
• s3:ListAccessGrantsInstances
• s3:ListAccessGrantsLocations
• s3:PutAccessGrantsInstanceResourcePolicy
• s3:UpdateAccessGrantsLocation

Amazon SageMaker

• sagemaker:CreateCluster
• sagemaker:DeleteCluster
• sagemaker:DescribeCluster
• sagemaker:DescribeClusterNode
• sagemaker:ListClusterNodes
• sagemaker:ListClusters
• sagemaker:UpdateCluster

AWS Secrets Manager

• secretsmanager:BatchGetSecretValue

AWS Security Hub

• securityhub:BatchGetConfigurationPolicyAssociations
• securityhub:CreateConfigurationPolicy
• securityhub:DeleteConfigurationPolicy
• securityhub:GetConfigurationPolicy
• securityhub:GetConfigurationPolicyAssociation
• securityhub:GetSecurityControlDefinition
• securityhub:ListConfigurationPolicies
• securityhub:ListConfigurationPolicyAssociations
• securityhub:StartConfigurationPolicyAssociation
• securityhub:StartConfigurationPolicyDisassociation
• securityhub:UpdateConfigurationPolicy
• securityhub:UpdateSecurityControl

AWS Security Token Service

• sts:SetContext

AWS SQL Workbench

• sqlworkbench:GetQSqlRecommendations
• sqlworkbench:UpdateAccountQSqlSettings

AWS Step Functions

• states:InvokeHTTPEndpoint
• states:RevealSecrets
• states:TestState

Amazon Transcribe

• transcribe:DeleteMedicalScribeJob
• transcribe:GetMedicalScribeJob
• transcribe:ListMedicalScribeJobs
• transcribe:StartMedicalScribeJob

AWS Trusted Advisor

• trustedadvisor:GetOrganizationRecommendation
• trustedadvisor:GetRecommendation
• trustedadvisor:ListChecks
• trustedadvisor:ListOrganizationRecommendationAccounts
• trustedadvisor:ListOrganizationRecommendationResources
• trustedadvisor:ListOrganizationRecommendations
• trustedadvisor:ListRecommendationResources
• trustedadvisor:ListRecommendations
• trustedadvisor:UpdateOrganizationRecommendationLifecycle
• trustedadvisor:UpdateRecommendationLifecycle

AWS B2B Data Interchange

• b2bi:CreateCapability
• b2bi:CreatePartnership
• b2bi:CreateProfile
• b2bi:CreateTransformer
• b2bi:DeleteCapability
• b2bi:DeletePartnership
• b2bi:DeleteProfile
• b2bi:DeleteTransformer
• b2bi:GetCapability
• b2bi:GetPartnership
• b2bi:GetProfile
• b2bi:GetTransformer
• b2bi:GetTransformerJob
• b2bi:ListCapabilities
• b2bi:ListPartnerships
• b2bi:ListProfiles
• b2bi:ListTagsForResource
• b2bi:ListTransformers
• b2bi:StartTransformerJob
• b2bi:TagResource
• b2bi:TestMapping
• b2bi:TestParsing
• b2bi:UntagResource
• b2bi:UpdateCapability
• b2bi:UpdatePartnership
• b2bi:UpdateProfile
• b2bi:UpdateTransformer

AWS Billing and Cost Management And Cost Management Data Exports

• bcm-data-exports:CreateExport
• bcm-data-exports:DeleteExport
• bcm-data-exports:GetExecution
• bcm-data-exports:GetExport
• bcm-data-exports:GetTable
• bcm-data-exports:ListExecutions
• bcm-data-exports:ListExports
• bcm-data-exports:ListTables
• bcm-data-exports:ListTagsForResource
• bcm-data-exports:TagResource
• bcm-data-exports:UntagResource
• bcm-data-exports:UpdateExport

AWS Clean Rooms ML

• cleanrooms-ml:CreateAudienceModel
• cleanrooms-ml:CreateConfiguredAudienceModel
• cleanrooms-ml:CreateTrainingDataset
• cleanrooms-ml:DeleteAudienceGenerationJob
• cleanrooms-ml:DeleteAudienceModel
• cleanrooms-ml:DeleteConfiguredAudienceModel
• cleanrooms-ml:DeleteConfiguredAudienceModelPolicy
• cleanrooms-ml:DeleteTrainingDataset
• cleanrooms-ml:GetAudienceGenerationJob
• cleanrooms-ml:GetAudienceModel
• cleanrooms-ml:GetConfiguredAudienceModel
• cleanrooms-ml:GetConfiguredAudienceModelPolicy
• cleanrooms-ml:GetTrainingDataset
• cleanrooms-ml:ListAudienceExportJobs
• cleanrooms-ml:ListAudienceGenerationJobs
• cleanrooms-ml:ListAudienceModels
• cleanrooms-ml:ListConfiguredAudienceModels
• cleanrooms-ml:ListTagsForResource
• cleanrooms-ml:ListTrainingDatasets
• cleanrooms-ml:PutConfiguredAudienceModelPolicy
• cleanrooms-ml:StartAudienceExportJob
• cleanrooms-ml:StartAudienceGenerationJob
• cleanrooms-ml:TagResource
• cleanrooms-ml:UnTagResource
• cleanrooms-ml:UpdateConfiguredAudienceModel

Amazon CloudFront KeyValueStore

• cloudfront-keyvaluestore:DeleteKey
• cloudfront-keyvaluestore:DescribeKeyValueStore
• cloudfront-keyvaluestore:GetKey
• cloudfront-keyvaluestore:ListKeys
• cloudfront-keyvaluestore:PutKey
• cloudfront-keyvaluestore:UpdateKeys

AWS Cost Optimization Hub

• cost-optimization-hub:GetPreferences
• cost-optimization-hub:GetRecommendation
• cost-optimization-hub:ListEnrollmentStatuses
• cost-optimization-hub:ListRecommendationSummaries
• cost-optimization-hub:ListRecommendations
• cost-optimization-hub:UpdateEnrollmentStatus
• cost-optimization-hub:UpdatePreferences

AWS Diagnostic tools

• ts:GetExecution
• ts:GetExecutionOutput
• ts:GetTool
• ts:ListExecutions
• ts:ListTagsForResource
• ts:ListTools
• ts:StartExecution
• ts:TagResource
• ts:UntagResource

Amazon EKS Auth

• eks-auth:AssumeRoleForPodIdentity

AWS IAM Identity Center OIDC service

• sso-oauth:CreateTokenWithIAM

Amazon InspectorScan

• inspector-scan:ScanSbom

AWS Marketplace Deployment Service

• aws-marketplace:ListTagsForResource
• aws-marketplace:PutDeploymentParameter
• aws-marketplace:TagResource
• aws-marketplace:UntagResource

Amazon Neptune Analytics

• neptune-graph:CancelImportTask
• neptune-graph:CancelQuery
• neptune-graph:CreateGraph
• neptune-graph:CreateGraphSnapshot
• neptune-graph:CreateGraphUsingImportTask
• neptune-graph:CreatePrivateGraphEndpoint
• neptune-graph:DeleteDataViaQuery
• neptune-graph:DeleteGraph
• neptune-graph:DeleteGraphSnapshot
• neptune-graph:DeletePrivateGraphEndpoint
• neptune-graph:GetEngineStatus
• neptune-graph:GetGraph
• neptune-graph:GetGraphSnapshot
• neptune-graph:GetGraphSummary
• neptune-graph:GetImportTask
• neptune-graph:GetPrivateGraphEndpoint
• neptune-graph:GetQueryStatus
• neptune-graph:GetStatisticsStatus
• neptune-graph:ListGraphSnapshots
• neptune-graph:ListGraphs
• neptune-graph:ListImportTasks
• neptune-graph:ListPrivateGraphEndpoints
• neptune-graph:ListQueries
• neptune-graph:ListTagsForResource
• neptune-graph:ReadDataViaQuery
• neptune-graph:ResetGraph
• neptune-graph:RestoreGraphFromSnapshot
• neptune-graph:TagResource
• neptune-graph:UntagResource
• neptune-graph:UpdateGraph
• neptune-graph:WriteDataViaQuery

AWS Network Manager Chat

• networkmanager-chat:CancelMessageResponse
• networkmanager-chat:CreateConversation
• networkmanager-chat:DeleteConversation
• networkmanager-chat:ListConversationMessages
• networkmanager-chat:ListConversations
• networkmanager-chat:NotifyConversationIsActive
• networkmanager-chat:SendConversationMessage

Amazon One Enterprise

• one:CreateDeviceActivationQrCode
• one:CreateDeviceConfigurationTemplate
• one:CreateDeviceInstance
• one:CreateDeviceInstanceConfiguration
• one:CreateSite
• one:DeleteAssociatedDevice
• one:DeleteDeviceConfigurationTemplate
• one:DeleteDeviceInstance
• one:DeleteSite
• one:DeleteUser
• one:GetDeviceConfigurationTemplate
• one:GetDeviceInstance
• one:GetDeviceInstanceConfiguration
• one:GetSite
• one:GetSiteAddress
• one:ListDeviceConfigurationTemplates
• one:ListDeviceInstances
• one:ListSites
• one:ListTagsForResource
• one:ListUsers
• one:RebootDevice
• one:TagResource
• one:UntagResource
• one:UpdateDeviceConfigurationTemplate
• one:UpdateDeviceInstance
• one:UpdateSite
• one:UpdateSiteAddress

Amazon Q

• q:GetConversation
• q:GetTroubleshootingResults
• q:SendMessage
• q:StartConversation
• q:StartTroubleshootingAnalysis
• q:StartTroubleshootingResolutionExplanation

Amazon Q Business

• qbusiness:AddUserLicenses
• qbusiness:BatchDeleteDocument
• qbusiness:BatchPutDocument
• qbusiness:Chat
• qbusiness:ChatSync
• qbusiness:CreateApplication
• qbusiness:CreateDataSource
• qbusiness:CreateIndex
• qbusiness:CreateLicense
• qbusiness:CreatePlugin
• qbusiness:CreateRetriever
• qbusiness:CreateUser
• qbusiness:CreateWebExperience
• qbusiness:DeleteApplication
• qbusiness:DeleteChatControlsConfiguration
• qbusiness:DeleteConversation
• qbusiness:DeleteDataSource
• qbusiness:DeleteGroup
• qbusiness:DeleteIndex
• qbusiness:DeletePlugin
• qbusiness:DeleteRetriever
• qbusiness:DeleteUser
• qbusiness:DeleteWebExperience
• qbusiness:GetApplication
• qbusiness:GetChatControlsConfiguration
• qbusiness:GetDataSource
• qbusiness:GetGroup
• qbusiness:GetIndex
• qbusiness:GetLicense
• qbusiness:GetPlugin
• qbusiness:GetRetriever
• qbusiness:GetUser
• qbusiness:GetWebExperience
• qbusiness:ListApplications
• qbusiness:ListConversations
• qbusiness:ListDataSourceSyncJobs
• qbusiness:ListDataSources
• qbusiness:ListDocuments
• qbusiness:ListGroups
• qbusiness:ListIndices
• qbusiness:ListMessages
• qbusiness:ListPlugins
• qbusiness:ListRetrievers
• qbusiness:ListTagsForResource
• qbusiness:ListUserLicenses
• qbusiness:ListWebExperiences
• qbusiness:PutFeedback
• qbusiness:PutGroup
• qbusiness:RemoveUserLicenses
• qbusiness:StartDataSourceSyncJob
• qbusiness:StopDataSourceSyncJob
• qbusiness:TagResource
• qbusiness:UntagResource
• qbusiness:UpdateApplication
• qbusiness:UpdateChatControlsConfiguration
• qbusiness:UpdateDataSource
• qbusiness:UpdateIndex
• qbusiness:UpdatePlugin
• qbusiness:UpdateRetriever
• qbusiness:UpdateUser
• qbusiness:UpdateWebExperience

Amazon Q in Connect

• wisdom:CreateAssistant
• wisdom:CreateAssistantAssociation
• wisdom:CreateContent
• wisdom:CreateKnowledgeBase
• wisdom:CreateQuickResponse
• wisdom:CreateSession
• wisdom:DeleteAssistant
• wisdom:DeleteAssistantAssociation
• wisdom:DeleteContent
• wisdom:DeleteImportJob
• wisdom:DeleteKnowledgeBase
• wisdom:DeleteQuickResponse
• wisdom:GetAssistant
• wisdom:GetAssistantAssociation
• wisdom:GetContent
• wisdom:GetContentSummary
• wisdom:GetImportJob
• wisdom:GetKnowledgeBase
• wisdom:GetQuickResponse
• wisdom:GetRecommendations
• wisdom:GetSession
• wisdom:ListAssistantAssociations
• wisdom:ListAssistants
• wisdom:ListContents
• wisdom:ListImportJobs
• wisdom:ListKnowledgeBases
• wisdom:ListQuickResponses
• wisdom:ListTagsForResource
• wisdom:NotifyRecommendationsReceived
• wisdom:PutFeedback
• wisdom:QueryAssistant
• wisdom:RemoveKnowledgeBaseTemplateUri
• wisdom:SearchContent
• wisdom:SearchQuickResponses
• wisdom:SearchSessions
• wisdom:StartContentUpload
• wisdom:StartImportJob
• wisdom:TagResource
• wisdom:UntagResource
• wisdom:UpdateContent
• wisdom:UpdateKnowledgeBaseTemplateUri
• wisdom:UpdateQuickResponse

AWS re:Post Private

• repostspace:CreateSpace
• repostspace:DeleteSpace
• repostspace:DeregisterAdmin
• repostspace:GetSpace
• repostspace:ListSpaces
• repostspace:ListTagsForResource
• repostspace:RegisterAdmin
• repostspace:SendInvites
• repostspace:TagResource
• repostspace:UntagResource
• repostspace:UpdateSpace

Amazon S3 Express

• s3express:CreateBucket
• s3express:CreateSession
• s3express:DeleteBucket
• s3express:DeleteBucketPolicy
• s3express:GetBucketPolicy
• s3express:ListAllMyDirectoryBuckets
• s3express:PutBucketPolicy

Amazon WorkSpaces Thin Client

• thinclient:CreateEnvironment
• thinclient:DeleteDevice
• thinclient:DeleteEnvironment
• thinclient:DeregisterDevice
• thinclient:GetDevice
• thinclient:GetEnvironment
• thinclient:GetSoftwareSet
• thinclient:ListDeviceSessions
• thinclient:ListDevices
• thinclient:ListEnvironments
• thinclient:ListSoftwareSets
• thinclient:ListTagsForResource
• thinclient:TagResource
• thinclient:UntagResource
• thinclient:UpdateDevice
• thinclient:UpdateEnvironment
• thinclient:UpdateSoftwareSet

AWS Backup

• backup:ListBackupJobSummaries
• backup:ListCopyJobSummaries
• backup:ListRestoreJobSummaries

Amazon Connect Wisdom

• wisdom:PutFeedback

AWS Control Tower

• controltower:ListTagsForResource
• controltower:TagResource
• controltower:UntagResource

AWS Cost Explorer Service

• ce:GetApproximateUsageRecords

Amazon FinSpace

• finspace:UpdateKxClusterCodeConfiguration

Amazon Redshift

• redshift:DeleteResourcePolicy
• redshift:DescribeInboundIntegrations
• redshift:GetResourcePolicy
• redshift:PutResourcePolicy

AWS Resource Explorer

• resource-explorer-2:GetAccountLevelServiceConfiguration
• resource-explorer-2:ListIndexesForMembers

Amazon S3

• s3:CreateStorageLensGroup
• s3:DeleteStorageLensGroup
• s3:GetStorageLensGroup
• s3:ListStorageLensGroups
• s3:ListTagsForResource
• s3:TagResource
• s3:UntagResource
• s3:UpdateStorageLensGroup

AWS Step Functions

• states:RedriveExecution

AWS Systems Manager Incident Manager

• ssm-incidents:BatchGetIncidentFindings
• ssm-incidents:ListIncidentFindings

Amazon CodeWhisperer

• codewhisperer:AllowVendedLogDeliveryForResource

AWS Launch Wizard

• launchwizard:CreateDeployment
• launchwizard:DeleteDeployment
• launchwizard:GetDeployment
• launchwizard:GetResourceRecommendation
• launchwizard:GetSettingsSet
• launchwizard:GetWorkload
• launchwizard:GetWorkloadAsset
• launchwizard:ListAllowedResources
• launchwizard:ListDeploymentEvents
• launchwizard:ListDeployments
• launchwizard:ListResourceCostEstimates
• launchwizard:ListWorkloadDeploymentPatterns
• launchwizard:PutSettingsSet

AWS Resource Groups

• resource-groups:AssociateResource
• resource-groups:DisassociateResource

Amazon CloudWatch Logs

• logs:CreateDelivery
• logs:DeleteDelivery
• logs:DeleteDeliveryDestination
• logs:DeleteDeliveryDestinationPolicy
• logs:DeleteDeliverySource
• logs:DescribeDeliveries
• logs:DescribeDeliveryDestinations
• logs:DescribeDeliverySources
• logs:GetDelivery
• logs:GetDeliveryDestination
• logs:GetDeliveryDestinationPolicy
• logs:GetDeliverySource
• logs:PutDeliveryDestination
• logs:PutDeliveryDestinationPolicy
• logs:PutDeliverySource

Amazon Comprehend

• comprehend:DetectToxicContent

Amazon EC2

• ec2:GetSecurityGroupsForVpc
• ec2:InjectApiError

Amazon Elastic Kubernetes Service

• eks:CreateEksAnywhereSubscription
• eks:DeleteEksAnywhereSubscription
• eks:DescribeEksAnywhereSubscription
• eks:ListEksAnywhereSubscriptions
• eks:UpdateEksAnywhereSubscription

Amazon RDS

• rds:CreateIntegration
• rds:CreateTenantDatabase
• rds:DeleteIntegration
• rds:DeleteTenantDatabase
• rds:DescribeDbSnapshotTenantDatabases
• rds:DescribeIntegrations
• rds:DescribeTenantDatabases
• rds:ModifyTenantDatabase

AWS Partner central account management

• partnercentral-account-management:AssociatePartnerAccount
• partnercentral-account-management:AssociatePartnerUser
• partnercentral-account-management:DisassociatePartnerUser

Amazon Connect

• connect:BatchPutContact

Amazon SageMaker

• sagemaker:CreateInferenceComponent
• sagemaker:DeleteInferenceComponent
• sagemaker:DescribeInferenceComponent
• sagemaker:InvokeEndpointWithResponseStream
• sagemaker:ListInferenceComponents
• sagemaker:UpdateInferenceComponent
• sagemaker:UpdateInferenceComponentRuntimeConfig

Amazon Cognito Identity

• cognito-identity:GetIdentityPoolAnalytics
• cognito-identity:GetIdentityPoolDailyAnalytics
• cognito-identity:GetIdentityProviderDailyAnalytics

AWS Systems Manager

• ssm:DeleteOpsItem

AWS Migration Hub Strategy Recommendations

• migrationhub-strategy:ListAnalyzableServers

Amazon Redshift

• redshift:FailoverPrimaryCompute

Amazon EMR Serverless

• emr-serverless:AccessInteractiveEndpoints

AWS Global Accelerator

• globalaccelerator:CreateCrossAccountAttachment
• globalaccelerator:DeleteCrossAccountAttachment
• globalaccelerator:DescribeCrossAccountAttachment
• globalaccelerator:ListCrossAccountAttachments
• globalaccelerator:ListCrossAccountResourceAccounts
• globalaccelerator:ListCrossAccountResources
• globalaccelerator:UpdateCrossAccountAttachment

AWS Data Exchange

• dataexchange:SendDataSetNotification

AWS DeepRacer

• deepracer:ListLeaderboardEvaluations

Amazon Redshift Serverless

• redshift-serverless:CreateCustomDomainAssociation
• redshift-serverless:DeleteCustomDomainAssociation
• redshift-serverless:GetCustomDomainAssociation
• redshift-serverless:ListCustomDomainAssociations
• redshift-serverless:UpdateCustomDomainAssociation

Amazon EC2

• ec2:DisableImage
• ec2:EnableImage

AWS Application Transformation Service

• application-transformation:GetGroupingAssessment
• application-transformation:GetPortingCompatibilityAssessment
• application-transformation:GetPortingRecommendationAssessment
• application-transformation:GetRuntimeAssessment
• application-transformation:PutLogData
• application-transformation:PutMetricData
• application-transformation:StartGroupingAssessment
• application-transformation:StartPortingCompatibilityAssessment
• application-transformation:StartPortingRecommendationAssessment
• application-transformation:StartRuntimeAssessment

AWS Migration Hub

• mgh:DeleteHomeRegionControl

Amazon OpenSearch Serverless

• aoss:BatchGetEffectiveLifecyclePolicy
• aoss:BatchGetLifecyclePolicy
• aoss:CreateLifecyclePolicy
• aoss:DeleteLifecyclePolicy
• aoss:ListLifecyclePolicies
• aoss:UpdateLifecyclePolicy

Amazon Braket

• braket:AcceptUserAgreement
• braket:AccessBraketFeature
• braket:GetServiceLinkedRoleStatus
• braket:GetUserAgreementStatus

Amazon Connect

• connect:BatchGetFlowAssociation
• connect:CreatePredefinedAttribute
• connect:DeletePredefinedAttribute
• connect:DescribePredefinedAttribute
• connect:ListPredefinedAttributes
• connect:ListSecurityProfileApplications
• connect:UpdatePhoneNumberMetadata
• connect:UpdatePredefinedAttribute

Amazon Connect Wisdom

• wisdom:CreateQuickResponse
• wisdom:DeleteImportJob
• wisdom:DeleteQuickResponse
• wisdom:GetImportJob
• wisdom:GetQuickResponse
• wisdom:ListImportJobs
• wisdom:ListQuickResponses
• wisdom:SearchQuickResponses
• wisdom:StartImportJob
• wisdom:UpdateQuickResponse

AWS Lake Formation

• lakeformation:CreateLakeFormationOptIn
• lakeformation:DeleteLakeFormationOptIn
• lakeformation:ListLakeFormationOptIns

Amazon Rekognition

• rekognition:GetMediaAnalysisJob
• rekognition:ListMediaAnalysisJobs
• rekognition:StartMediaAnalysisJob

Amazon Redshift Serverless

• redshift-serverless:DescribeOneTimeCredit

Amazon AppIntegrations

• app-integrations:CreateApplication
• app-integrations:GetApplication
• app-integrations:ListApplications
• app-integrations:UpdateApplication

AWS Application Discovery Service

• discovery:BatchDeleteAgents
• discovery:DescribeBatchDeleteConfigurationTask
• discovery:StartBatchDeleteConfigurationTask

Amazon Chime

• chime:CreateMediaPipelineKinesisVideoStreamPool
• chime:CreateMediaStreamPipeline
• chime:DeleteMediaPipelineKinesisVideoStreamPool
• chime:GetMediaPipelineKinesisVideoStreamPool
• chime:ListMediaPipelineKinesisVideoStreamPools
• chime:UpdateMediaPipelineKinesisVideoStreamPool

Amazon CodeWhisperer

• codewhisperer:AssociateCustomizationPermission
• codewhisperer:CreateCustomization
• codewhisperer:DeleteCustomization
• codewhisperer:DisassociateCustomizationPermission
• codewhisperer:GetCustomization
• codewhisperer:ListCustomizationPermissions
• codewhisperer:ListCustomizations
• codewhisperer:UpdateCustomization

Amazon Managed Streaming for Apache Kafka

• kafka:CreateReplicator
• kafka:DeleteReplicator
• kafka:DescribeReplicator
• kafka:ListReplicators
• kafka:UpdateReplicationInfo

Amazon OpenSearch Service

• es:GetDomainMaintenanceStatus
• es:ListDomainMaintenances
• es:StartDomainMaintenance

Amazon Route 53 Recovery Controls

• route53-recovery-control-config:GetResourcePolicy

AWS Control Tower

• controltower:GetEnabledControl

AWS Entity Resolution

• entityresolution:CreateIdMappingWorkflow
• entityresolution:DeleteIdMappingWorkflow
• entityresolution:GetIdMappingJob
• entityresolution:GetIdMappingWorkflow
• entityresolution:GetProviderService
• entityresolution:ListIdMappingJobs
• entityresolution:ListIdMappingWorkflows
• entityresolution:ListProviderServices
• entityresolution:StartIdMappingJob
• entityresolution:UpdateIdMappingWorkflow
• entityresolution:UpdateSchemaMapping

Amazon FSx

• fsx:StartMisconfiguredStateRecovery

Amazon Managed Blockchain Query

• managedblockchain-query:GetAssetContract
• managedblockchain-query:ListAssetContracts

AWS Elemental MediaLive

• medialive:StartInputDevice
• medialive:StopInputDevice

AWS IoT FleetWise

• iotfleetwise:GetEncryptionConfiguration
• iotfleetwise:PutEncryptionConfiguration

AWS Support

• support:DescribeCommunication

Amazon Textract

• textract:CreateAdapter
• textract:CreateAdapterVersion
• textract:DeleteAdapter
• textract:DeleteAdapterVersion
• textract:GetAdapter
• textract:GetAdapterVersion
• textract:ListAdapterVersions
• textract:ListAdapters
• textract:ListTagsForResource
• textract:TagResource
• textract:UntagResource
• textract:UpdateAdapter

AWS Database Migration Service

• dms:DescribeEngineVersions

AWS Directory Service

• ds:DisableRoleAccess
• ds:EnableRoleAccess
• ds:UpdateDirectory

Amazon WorkSpaces

• workspaces:AssociateWorkspaceApplication
• workspaces:DeployWorkspaceApplications
• workspaces:DescribeApplicationAssociations
• workspaces:DescribeApplications
• workspaces:DescribeBundleAssociations
• workspaces:DescribeImageAssociations
• workspaces:DescribeWorkspaceAssociations
• workspaces:DisassociateWorkspaceApplication

AWS Well-Architected Tool

• wellarchitected:CreateReviewTemplate
• wellarchitected:CreateTemplateShare
• wellarchitected:DeleteReviewTemplate
• wellarchitected:DeleteTemplateShare
• wellarchitected:GetReviewTemplate
• wellarchitected:GetReviewTemplateAnswer
• wellarchitected:GetReviewTemplateLensReview
• wellarchitected:ListReviewTemplateAnswers
• wellarchitected:ListReviewTemplates
• wellarchitected:ListTemplateShares
• wellarchitected:UpdateReviewTemplate
• wellarchitected:UpdateReviewTemplateAnswer
• wellarchitected:UpdateReviewTemplateLensReview
• wellarchitected:UpgradeReviewTemplateLensReview

AWS App Runner

• apprunner:ListServicesForAutoScalingConfiguration
• apprunner:UpdateDefaultAutoScalingConfiguration

Amazon Bedrock

• bedrock:CreateFoundationModelAgreement
• bedrock:CreateProvisionedModelThroughput
• bedrock:DeleteFoundationModelAgreement
• bedrock:DeleteModelInvocationLoggingConfiguration
• bedrock:DeleteProvisionedModelThroughput
• bedrock:GetFoundationModelAvailability
• bedrock:GetModelInvocationLoggingConfiguration
• bedrock:GetProvisionedModelThroughput
• bedrock:GetUseCaseForModelAccess
• bedrock:ListFoundationModelAgreementOffers
• bedrock:ListProvisionedModelThroughputs
• bedrock:PutFoundationModelEntitlement
• bedrock:PutModelInvocationLoggingConfiguration
• bedrock:PutUseCaseForModelAccess
• bedrock:UpdateProvisionedModelThroughput

Amazon RDS

• rds:SwitchoverGlobalCluster

AWS Application Migration Service

• mgn:CreateConnector
• mgn:DeleteConnector
• mgn:ListConnectors
• mgn:UpdateConnector
• mgn:UpdateSourceServer

Amazon DataZone

• datazone:AcceptPredictions
• datazone:AcceptSubscriptionRequest
• datazone:CancelSubscription
• datazone:CreateAsset
• datazone:CreateAssetRevision
• datazone:CreateAssetType
• datazone:CreateDataSource
• datazone:CreateDomain
• datazone:CreateEnvironment
• datazone:CreateEnvironmentBlueprint
• datazone:CreateEnvironmentProfile
• datazone:CreateFormType
• datazone:CreateGlossary
• datazone:CreateGlossaryTerm
• datazone:CreateGroupProfile
• datazone:CreateListingChangeSet
• datazone:CreateProject
• datazone:CreateProjectMembership
• datazone:CreateSubscriptionGrant
• datazone:CreateSubscriptionRequest
• datazone:CreateSubscriptionTarget
• datazone:CreateUserProfile
• datazone:DeleteAsset
• datazone:DeleteAssetType
• datazone:DeleteDataSource
• datazone:DeleteDomain
• datazone:DeleteDomainSharingPolicy
• datazone:DeleteEnvironment
• datazone:DeleteEnvironmentBlueprint
• datazone:DeleteEnvironmentBlueprintConfiguration
• datazone:DeleteEnvironmentProfile
• datazone:DeleteFormType
• datazone:DeleteGlossary
• datazone:DeleteGlossaryTerm
• datazone:DeleteListing
• datazone:DeleteProject
• datazone:DeleteProjectMembership
• datazone:DeleteSubscriptionGrant
• datazone:DeleteSubscriptionRequest
• datazone:DeleteSubscriptionTarget
• datazone:GetAsset
• datazone:GetAssetType
• datazone:GetDataSource
• datazone:GetDataSourceRun
• datazone:GetDomain
• datazone:GetDomainSharingPolicy
• datazone:GetEnvironment
• datazone:GetEnvironmentActionLink
• datazone:GetEnvironmentBlueprint
• datazone:GetEnvironmentBlueprintConfiguration
• datazone:GetEnvironmentCredentials
• datazone:GetEnvironmentProfile
• datazone:GetFormType
• datazone:GetGlossary
• datazone:GetGlossaryTerm
• datazone:GetGroupProfile
• datazone:GetIamPortalLoginUrl
• datazone:GetListing
• datazone:GetSubscription
• datazone:GetSubscriptionEligibility
• datazone:GetSubscriptionGrant
• datazone:GetSubscriptionRequestDetails
• datazone:GetSubscriptionTarget
• datazone:GetUserProfile
• datazone:ListAccountEnvironments
• datazone:ListAssetRevisions
• datazone:ListDataSourceRunActivities
• datazone:ListDataSourceRuns
• datazone:ListDataSources
• datazone:ListDomains
• datazone:ListEnvironmentBlueprintConfigurations
• datazone:ListEnvironmentBlueprints
• datazone:ListEnvironmentProfiles
• datazone:ListEnvironments
• datazone:ListGroupsForUser
• datazone:ListNotifications
• datazone:ListProjectMemberships
• datazone:ListSubscriptionGrants
• datazone:ListSubscriptionRequests
• datazone:ListSubscriptionTargets
• datazone:ListSubscriptions
• datazone:ListTagsForResource
• datazone:ListWarehouseMetadata
• datazone:ProvisionDomain
• datazone:PutDomainSharingPolicy
• datazone:PutEnvironmentBlueprintConfiguration
• datazone:RefreshToken
• datazone:RejectPredictions
• datazone:RejectSubscriptionRequest
• datazone:RevokeSubscription
• datazone:Search
• datazone:SearchGroupProfiles
• datazone:SearchListings
• datazone:SearchTypes
• datazone:SearchUserProfiles
• datazone:SsoLogin
• datazone:SsoLogout
• datazone:StartDataSourceRun
• datazone:TagResource
• datazone:UntagResource
• datazone:UpdateDataSource
• datazone:UpdateDomain
• datazone:UpdateEnvironment
• datazone:UpdateEnvironmentBlueprint
• datazone:UpdateEnvironmentConfiguration
• datazone:UpdateEnvironmentDeploymentStatus
• datazone:UpdateEnvironmentProfile
• datazone:UpdateGlossary
• datazone:UpdateGlossaryTerm
• datazone:UpdateGroupProfile
• datazone:UpdateProject
• datazone:UpdateSubscriptionGrantStatus
• datazone:UpdateSubscriptionRequest
• datazone:UpdateSubscriptionTarget
• datazone:UpdateUserProfile
• datazone:ValidatePassRole

Amazon Bedrock

• bedrock:AssociateAgentKnowledgeBase
• bedrock:AssociateThirdPartyKnowledgeBase
• bedrock:CreateDataSource
• bedrock:CreateKnowledgeBase
• bedrock:DeleteDataSource
• bedrock:DeleteKnowledgeBase
• bedrock:DisassociateAgentKnowledgeBase
• bedrock:GetAgentKnowledgeBase
• bedrock:GetDataSource
• bedrock:GetFoundationModel
• bedrock:GetIngestionJob
• bedrock:GetKnowledgeBase
• bedrock:ListAgentKnowledgeBases
• bedrock:ListDataSources
• bedrock:ListIngestionJobs
• bedrock:ListKnowledgeBases
• bedrock:QueryKnowledgeBase
• bedrock:StartIngestionJob
• bedrock:UpdateAgentKnowledgeBase
• bedrock:UpdateDataSource
• bedrock:UpdateKnowledgeBase

Amazon WorkMail

• workmail:DescribeEntity
• workmail:ListGroupsForEntity
• workmail:UpdateGroup
• workmail:UpdateUser

Amazon Lookout for Equipment

• lookoutequipment:CreateRetrainingScheduler
• lookoutequipment:DeleteRetrainingScheduler
• lookoutequipment:DescribeRetrainingScheduler
• lookoutequipment:ListRetrainingSchedulers
• lookoutequipment:StartRetrainingScheduler
• lookoutequipment:StopRetrainingScheduler
• lookoutequipment:UpdateModel
• lookoutequipment:UpdateRetrainingScheduler

AWS Amplify UI Builder

• amplifyuibuilder:ExchangeCodeForToken
• amplifyuibuilder:RefreshToken

AWS Cloud Map

• servicediscovery:DiscoverInstancesRevision

Amazon EC2

• ec2:DisableImageBlockPublicAccess
• ec2:EnableImageBlockPublicAccess
• ec2:GetImageBlockPublicAccessState

AWS Health APIs and Notifications

• health:DescribeEntityAggregatesForOrganization

AWS Elastic Disaster Recovery

• drs:DeleteLaunchAction
• drs:ListLaunchActions
• drs:PutLaunchAction

Amazon Connect

• connect:CreateView
• connect:CreateViewVersion
• connect:DeleteView
• connect:DeleteViewVersion
• connect:DescribeView
• connect:ListViewVersions
• connect:ListViews
• connect:UpdateViewContent
• connect:UpdateViewMetadata

Amazon SageMaker

• sagemaker:GetScalingConfigurationRecommendation

Amazon CloudWatch Internet Monitor

• internetmonitor:GetQueryResults
• internetmonitor:GetQueryStatus
• internetmonitor:StartQuery
• internetmonitor:StopQuery

Amazon Simple Email Service v2

• ses:CancelExportJob
• ses:CreateExportJob
• ses:GetExportJob
• ses:GetMessageInsights
• ses:ListExportJobs

AWS CodeCommit

• codecommit:ListFileCommitHistory

AWS Compute Optimizer

• compute-optimizer:ExportLicenseRecommendations
• compute-optimizer:GetLicenseRecommendations

AWS Private CA Connector for Active Directory

• pca-connector-ad:CreateConnector
• pca-connector-ad:CreateDirectoryRegistration
• pca-connector-ad:CreateServicePrincipalName
• pca-connector-ad:CreateTemplate
• pca-connector-ad:CreateTemplateGroupAccessControlEntry
• pca-connector-ad:DeleteConnector
• pca-connector-ad:DeleteDirectoryRegistration
• pca-connector-ad:DeleteServicePrincipalName
• pca-connector-ad:DeleteTemplate
• pca-connector-ad:DeleteTemplateGroupAccessControlEntry
• pca-connector-ad:GetConnector
• pca-connector-ad:GetDirectoryRegistration
• pca-connector-ad:GetServicePrincipalName
• pca-connector-ad:GetTemplate
• pca-connector-ad:GetTemplateGroupAccessControlEntry
• pca-connector-ad:ListConnectors
• pca-connector-ad:ListDirectoryRegistrations
• pca-connector-ad:ListServicePrincipalNames
• pca-connector-ad:ListTagsForResource
• pca-connector-ad:ListTemplateGroupAccessControlEntries
• pca-connector-ad:ListTemplates
• pca-connector-ad:TagResource
• pca-connector-ad:UntagResource
• pca-connector-ad:UpdateTemplate
• pca-connector-ad:UpdateTemplateGroupAccessControlEntry

Amazon Personalize

• personalize:CreateDataInsightsJob
• personalize:DescribeDataInsightsJob
• personalize:GetDataInsights
• personalize:ListDataInsightsJobs

Amazon SageMaker

• sagemaker:ListResourceCatalogs

Amazon Cognito User Pools

• cognito-idp:GetLogDeliveryConfiguration
• cognito-idp:SetLogDeliveryConfiguration

AWS Marketplace Vendor Insights

• vendor-insights:UpdateDataSource

AWS Amplify UI Builder

• amplifyuibuilder:GetCodegenJob
• amplifyuibuilder:ListCodegenJobs
• amplifyuibuilder:StartCodegenJob

AWS HealthOmics

• omics:AcceptShare
• omics:CreateAnnotationStoreVersion
• omics:CreateShare
• omics:DeleteAnnotationStoreVersions
• omics:DeleteShare
• omics:GetAnnotationStoreVersion
• omics:GetShare
• omics:ListAnnotationStoreVersions
• omics:ListShares
• omics:UpdateAnnotationStoreVersion

AWS Performance Insights

• pi:CreatePerformanceAnalysisReport
• pi:DeletePerformanceAnalysisReport
• pi:GetPerformanceAnalysisReport
• pi:ListPerformanceAnalysisReports
• pi:ListTagsForResource
• pi:TagResource
• pi:UntagResource

Amazon Connect

• connect:AssociateTrafficDistributionGroupUser
• connect:DisassociateTrafficDistributionGroupUser
• connect:ListTrafficDistributionGroupUsers

Amazon ElastiCache

• elasticache:TestMigration

AWS Snowball

• snowball:ListPickupLocations

AWS Migration Acceleration Program Credits

• mapcredits:ListAssociatedPrograms
• mapcredits:ListQuarterCredits
• mapcredits:ListQuarterSpend

AWS Backup

• backup:CreateLogicallyAirGappedBackupVault
• backup:DeleteBackupVaultSharingPolicy
• backup:GetBackupVaultSharingPolicy
• backup:ListProtectedResourcesByBackupVault
• backup:PutBackupVaultSharingPolicy

Amazon Bedrock

• bedrock:CreateAgent
• bedrock:CreateAgentActionGroup
• bedrock:CreateAgentAlias
• bedrock:CreateAgentDraftSnapshot
• bedrock:GetAgent
• bedrock:GetAgentActionGroup
• bedrock:GetAgentAlias
• bedrock:GetAgentVersion
• bedrock:InvokeAgent
• bedrock:ListAgentActionGroups
• bedrock:ListAgentAliases
• bedrock:ListAgentVersions
• bedrock:ListAgents
• bedrock:UpdateAgent
• bedrock:UpdateAgentActionGroup
• bedrock:UpdateAgentAlias

AWS Artifact

• artifact:GetAccountSettings
• artifact:PutAccountSettings

Amazon CloudWatch Application Insights

• applicationinsights:AddWorkload
• applicationinsights:DescribeWorkload
• applicationinsights:ListWorkloads
• applicationinsights:RemoveWorkload
• applicationinsights:UpdateProblem
• applicationinsights:UpdateWorkload

Amazon Connect

• connect:UpdateRoutingProfileAgentAvailabilityTimer

AWS IQ Permissions

• iq-permission:AssumePermissionRole

AWS DataSync

• datasync:CreateLocationAzureBlob
• datasync:DescribeLocationAzureBlob
• datasync:UpdateLocationAzureBlob

Amazon RDS

• rds:DeleteDBClusterAutomatedBackup
• rds:DescribeDBClusterAutomatedBackups

AWS Resilience Hub

• resiliencehub:AddDraftAppVersionResourceMappings
• resiliencehub:BatchUpdateRecommendationStatus
• resiliencehub:CreateApp
• resiliencehub:CreateAppVersionAppComponent
• resiliencehub:CreateAppVersionResource
• resiliencehub:CreateRecommendationTemplate
• resiliencehub:CreateResiliencyPolicy
• resiliencehub:DeleteApp
• resiliencehub:DeleteAppAssessment
• resiliencehub:DeleteAppInputSource
• resiliencehub:DeleteAppVersionAppComponent
• resiliencehub:DeleteAppVersionResource
• resiliencehub:DeleteRecommendationTemplate
• resiliencehub:DeleteResiliencyPolicy
• resiliencehub:DescribeApp
• resiliencehub:DescribeAppAssessment
• resiliencehub:DescribeAppVersion
• resiliencehub:DescribeAppVersionAppComponent
• resiliencehub:DescribeAppVersionResource
• resiliencehub:DescribeAppVersionResourcesResolutionStatus
• resiliencehub:DescribeAppVersionTemplate
• resiliencehub:DescribeDraftAppVersionResourcesImportStatus
• resiliencehub:DescribeResiliencyPolicy
• resiliencehub:ImportResourcesToDraftAppVersion
• resiliencehub:ListAlarmRecommendations
• resiliencehub:ListAppAssessmentComplianceDrifts
• resiliencehub:ListAppAssessments
• resiliencehub:ListAppComponentCompliances
• resiliencehub:ListAppComponentRecommendations
• resiliencehub:ListAppInputSources
• resiliencehub:ListAppVersionAppComponents
• resiliencehub:ListAppVersionResourceMappings
• resiliencehub:ListAppVersionResources
• resiliencehub:ListAppVersions
• resiliencehub:ListApps
• resiliencehub:ListRecommendationTemplates
• resiliencehub:ListResiliencyPolicies
• resiliencehub:ListSopRecommendations
• resiliencehub:ListSuggestedResiliencyPolicies
• resiliencehub:ListTagsForResource
• resiliencehub:ListTestRecommendations
• resiliencehub:ListUnsupportedAppVersionResources
• resiliencehub:PublishAppVersion
• resiliencehub:PutDraftAppVersionTemplate
• resiliencehub:RemoveDraftAppVersionResourceMappings
• resiliencehub:ResolveAppVersionResources
• resiliencehub:StartAppAssessment
• resiliencehub:TagResource
• resiliencehub:UntagResource
• resiliencehub:UpdateApp
• resiliencehub:UpdateAppVersion
• resiliencehub:UpdateAppVersionAppComponent
• resiliencehub:UpdateAppVersionResource
• resiliencehub:UpdateResiliencyPolicy